xmrig | 7e7505e180b234d7a466c564d6afaf609a237173bf90a2d745cc6dd00153c794

Analysis

max time kernel
34s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
Size

1.9MB
MD5

08e9e6027acf20cbc830e6e2208d7375
SHA1

54a0680641abfa78358aeaca6a494d871f3cb7c3
SHA256

7e7505e180b234d7a466c564d6afaf609a237173bf90a2d745cc6dd00153c794
SHA512

d43ca8ad75854b2cf9cdc3bd3f1aa62f06d6af4547b30b48e80fca60f00b37e54d9299da41be221f483a29ef14c2578a8ef01cad5e8bd3894db4eaebdc20ab60
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1V:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/1908-13-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2668-125-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2696-133-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2816-123-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2552-119-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2560-116-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2864-110-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2636-108-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1908	kJeaFAA.exe
2636	POlmTHy.exe
2864	NFShACU.exe
2560	NaAsYsT.exe
2552	BEZaluM.exe
2816	wqufjyL.exe
2668	JpkwPgq.exe
2696	lOUijFC.exe
2556	QsnHhxx.exe
1732	AQdkgXs.exe
2608	epqwkwY.exe
2488	NzfarpT.exe
2956	nfjguZs.exe
2612	YPMTbwA.exe
2912	mDYVMzv.exe
2168	WvFcMWk.exe
2416	VPCKpGv.exe
1680	nzQTgHP.exe
1092	vTZeqBE.exe
2176	fqJwSJF.exe
2784	acmxiDl.exe
2296	MRaAkqi.exe
332	ZsGcMzD.exe
2116	sdvjONT.exe
2084	WFUMgTM.exe
784	eAXxdas.exe
1492	WPPpsbh.exe
1488	tpuBUGu.exe
2272	KvJRpYX.exe
1760	GwFUmGz.exe
1484	vOaLUJL.exe
3028	cvcDWUw.exe
344	WgKHoCL.exe
1672	vLomrqM.exe
992	uxqufbI.exe
1368	rGFcqaP.exe
1700	cQvKYyd.exe
1880	otaHrhD.exe
292	YtTqhAi.exe
612	rNiRLef.exe
3012	CwhWoBg.exe
2964	uQAUZBx.exe
2904	xSPymvQ.exe
2248	dpLOYyy.exe
2212	fjrozdn.exe
1924	dlznDzr.exe
2916	PHnToUk.exe
2360	TBSQUKj.exe
896	nJnUaLS.exe
2044	RWIkedY.exe
1604	SAnOjrS.exe
2356	GuKXRxk.exe
2996	RnEwoAY.exe
3024	FhKPDou.exe
2652	AZcDTHh.exe
2468	RPPOpPU.exe
2932	OMDIfmO.exe
2788	BaHmVmj.exe
2708	pDjOyBx.exe
2516	ymEpTGf.exe
2780	GZElsSg.exe
2320	ligsjOs.exe
2836	hywHeJA.exe
2336	ohfPTWU.exe

Loads dropped DLL 64 IoCs

pid	Process
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2844-0-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x000b000000015cff-6.dat	upx
behavioral1/files/0x0038000000015d6b-15.dat	upx
behavioral1/memory/1908-13-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-22.dat	upx
behavioral1/files/0x0007000000015f65-38.dat	upx
behavioral1/files/0x000900000001621e-35.dat	upx
behavioral1/files/0x0007000000015fe5-48.dat	upx
behavioral1/files/0x0006000000016d20-47.dat	upx
behavioral1/files/0x0006000000016d43-66.dat	upx
behavioral1/files/0x0006000000016d3a-65.dat	upx
behavioral1/files/0x0007000000016d18-68.dat	upx
behavioral1/files/0x0006000000016d34-72.dat	upx
behavioral1/files/0x0006000000016d74-82.dat	upx
behavioral1/files/0x0006000000016d9d-94.dat	upx
behavioral1/files/0x0006000000016db1-101.dat	upx
behavioral1/files/0x0006000000016d8e-87.dat	upx
behavioral1/files/0x0006000000016da5-95.dat	upx
behavioral1/files/0x0006000000016dbe-126.dat	upx
behavioral1/files/0x000600000001708b-138.dat	upx
behavioral1/files/0x00060000000173d0-155.dat	upx
behavioral1/memory/2668-125-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x0035000000015d7f-156.dat	upx
behavioral1/files/0x00050000000186fa-190.dat	upx
behavioral1/files/0x0005000000018665-180.dat	upx
behavioral1/files/0x00050000000186f6-185.dat	upx
behavioral1/files/0x0015000000018644-170.dat	upx
behavioral1/files/0x0031000000018649-174.dat	upx
behavioral1/files/0x0006000000017437-165.dat	upx
behavioral1/files/0x00060000000171df-151.dat	upx
behavioral1/files/0x000600000001704a-149.dat	upx
behavioral1/memory/2696-133-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2816-123-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x0006000000016db9-121.dat	upx
behavioral1/memory/2552-119-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2560-116-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2864-110-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2636-108-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/files/0x0006000000016d5f-77.dat	upx
behavioral1/files/0x0006000000016d3e-57.dat	upx
behavioral1/files/0x0008000000015ecc-33.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CPBPpyq.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\zxyzURG.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\Wnzfthe.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\MKurTPi.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\xIOPkpj.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\FYFAwVM.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\kfehgrh.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\tWnZfkT.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\OigAKNt.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\DIxLwDY.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\KpWLZyt.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\yVXAymU.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\tyhzJIq.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\zuDLgkM.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\GgCGUPQ.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\oXDeADe.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\Mgmkjpw.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\yVOQTBX.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\bLUOyti.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\EFLWizG.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\hoVEQMB.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\IvPnkju.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\wjGGwme.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\gzfNISD.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\SiwjhBY.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\vdryunV.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\erYyIUk.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\FuQpMjs.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\VAiFFAh.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\XaMOUxz.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\OouRxaL.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\UVWjpFF.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\FnMMFlj.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\RClGaHc.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\vOaLUJL.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\GirNvmr.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\HCsCOHx.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\yhxHfPi.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\zHoBbnb.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\pYbCTFD.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\dsPLfGo.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\tccZTLv.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\HFPjVjX.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\gLBCgIk.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\tLJlhgD.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\UMAiEMo.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\UFkeBOO.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\czDBeNw.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\oiLZYbK.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\cPyDDMN.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\AUwvaKc.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\FeezDgA.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\yGfHOSl.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\PVOGpfd.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\QxjeBJw.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\eLaKNnd.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\THKGjSQ.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\RVuDOrW.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\NEoInVn.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\tJpFxAe.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\xzEHRxT.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\vqqPyrE.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\uoQfJTw.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\HREeUvE.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
Token: SeDebugPrivilege	2376	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2376	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	29
PID 2844 wrote to memory of 2376	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	29
PID 2844 wrote to memory of 2376	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	29
PID 2844 wrote to memory of 1908	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	30
PID 2844 wrote to memory of 1908	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	30
PID 2844 wrote to memory of 1908	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2636	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	31
PID 2844 wrote to memory of 2636	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	31
PID 2844 wrote to memory of 2636	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	31
PID 2844 wrote to memory of 2864	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	32
PID 2844 wrote to memory of 2864	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	32
PID 2844 wrote to memory of 2864	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	32
PID 2844 wrote to memory of 2560	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	33
PID 2844 wrote to memory of 2560	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	33
PID 2844 wrote to memory of 2560	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	33
PID 2844 wrote to memory of 2552	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	34
PID 2844 wrote to memory of 2552	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	34
PID 2844 wrote to memory of 2552	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	34
PID 2844 wrote to memory of 2696	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	35
PID 2844 wrote to memory of 2696	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	35
PID 2844 wrote to memory of 2696	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	35
PID 2844 wrote to memory of 2816	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	36
PID 2844 wrote to memory of 2816	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	36
PID 2844 wrote to memory of 2816	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	36
PID 2844 wrote to memory of 2608	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	37
PID 2844 wrote to memory of 2608	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	37
PID 2844 wrote to memory of 2608	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	37
PID 2844 wrote to memory of 2668	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	38
PID 2844 wrote to memory of 2668	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	38
PID 2844 wrote to memory of 2668	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	38
PID 2844 wrote to memory of 2488	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	39
PID 2844 wrote to memory of 2488	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	39
PID 2844 wrote to memory of 2488	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	39
PID 2844 wrote to memory of 2556	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	40
PID 2844 wrote to memory of 2556	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	40
PID 2844 wrote to memory of 2556	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	40
PID 2844 wrote to memory of 2956	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	41
PID 2844 wrote to memory of 2956	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	41
PID 2844 wrote to memory of 2956	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	41
PID 2844 wrote to memory of 1732	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	42
PID 2844 wrote to memory of 1732	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	42
PID 2844 wrote to memory of 1732	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	42
PID 2844 wrote to memory of 2612	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	43
PID 2844 wrote to memory of 2612	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	43
PID 2844 wrote to memory of 2612	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	43
PID 2844 wrote to memory of 2912	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	44
PID 2844 wrote to memory of 2912	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	44
PID 2844 wrote to memory of 2912	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	44
PID 2844 wrote to memory of 2168	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	45
PID 2844 wrote to memory of 2168	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	45
PID 2844 wrote to memory of 2168	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	45
PID 2844 wrote to memory of 2416	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	46
PID 2844 wrote to memory of 2416	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	46
PID 2844 wrote to memory of 2416	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	46
PID 2844 wrote to memory of 1092	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	47
PID 2844 wrote to memory of 1092	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	47
PID 2844 wrote to memory of 1092	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	47
PID 2844 wrote to memory of 1680	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	48
PID 2844 wrote to memory of 1680	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	48
PID 2844 wrote to memory of 1680	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	48
PID 2844 wrote to memory of 2176	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	49
PID 2844 wrote to memory of 2176	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	49
PID 2844 wrote to memory of 2176	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	49
PID 2844 wrote to memory of 2784	2844	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\System\kJeaFAA.exe
  C:\Windows\System\kJeaFAA.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\POlmTHy.exe
  C:\Windows\System\POlmTHy.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\NFShACU.exe
  C:\Windows\System\NFShACU.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\NaAsYsT.exe
  C:\Windows\System\NaAsYsT.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\BEZaluM.exe
  C:\Windows\System\BEZaluM.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\lOUijFC.exe
  C:\Windows\System\lOUijFC.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\wqufjyL.exe
  C:\Windows\System\wqufjyL.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\epqwkwY.exe
  C:\Windows\System\epqwkwY.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\JpkwPgq.exe
  C:\Windows\System\JpkwPgq.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\NzfarpT.exe
  C:\Windows\System\NzfarpT.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\QsnHhxx.exe
  C:\Windows\System\QsnHhxx.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\nfjguZs.exe
  C:\Windows\System\nfjguZs.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\AQdkgXs.exe
  C:\Windows\System\AQdkgXs.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\YPMTbwA.exe
  C:\Windows\System\YPMTbwA.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\mDYVMzv.exe
  C:\Windows\System\mDYVMzv.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\WvFcMWk.exe
  C:\Windows\System\WvFcMWk.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\VPCKpGv.exe
  C:\Windows\System\VPCKpGv.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\vTZeqBE.exe
  C:\Windows\System\vTZeqBE.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\nzQTgHP.exe
  C:\Windows\System\nzQTgHP.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\fqJwSJF.exe
  C:\Windows\System\fqJwSJF.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\acmxiDl.exe
  C:\Windows\System\acmxiDl.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\ZsGcMzD.exe
  C:\Windows\System\ZsGcMzD.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\MRaAkqi.exe
  C:\Windows\System\MRaAkqi.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\sdvjONT.exe
  C:\Windows\System\sdvjONT.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\WFUMgTM.exe
  C:\Windows\System\WFUMgTM.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\eAXxdas.exe
  C:\Windows\System\eAXxdas.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\WPPpsbh.exe
  C:\Windows\System\WPPpsbh.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\tpuBUGu.exe
  C:\Windows\System\tpuBUGu.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\KvJRpYX.exe
  C:\Windows\System\KvJRpYX.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\GwFUmGz.exe
  C:\Windows\System\GwFUmGz.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\vOaLUJL.exe
  C:\Windows\System\vOaLUJL.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\cvcDWUw.exe
  C:\Windows\System\cvcDWUw.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\WgKHoCL.exe
  C:\Windows\System\WgKHoCL.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\uxqufbI.exe
  C:\Windows\System\uxqufbI.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\vLomrqM.exe
  C:\Windows\System\vLomrqM.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\rGFcqaP.exe
  C:\Windows\System\rGFcqaP.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\cQvKYyd.exe
  C:\Windows\System\cQvKYyd.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\otaHrhD.exe
  C:\Windows\System\otaHrhD.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\YtTqhAi.exe
  C:\Windows\System\YtTqhAi.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\rNiRLef.exe
  C:\Windows\System\rNiRLef.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\CwhWoBg.exe
  C:\Windows\System\CwhWoBg.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\uQAUZBx.exe
  C:\Windows\System\uQAUZBx.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\xSPymvQ.exe
  C:\Windows\System\xSPymvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\dlznDzr.exe
  C:\Windows\System\dlznDzr.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\dpLOYyy.exe
  C:\Windows\System\dpLOYyy.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\PHnToUk.exe
  C:\Windows\System\PHnToUk.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\fjrozdn.exe
  C:\Windows\System\fjrozdn.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\nJnUaLS.exe
  C:\Windows\System\nJnUaLS.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\TBSQUKj.exe
  C:\Windows\System\TBSQUKj.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\RWIkedY.exe
  C:\Windows\System\RWIkedY.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\SAnOjrS.exe
  C:\Windows\System\SAnOjrS.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\GuKXRxk.exe
  C:\Windows\System\GuKXRxk.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\RnEwoAY.exe
  C:\Windows\System\RnEwoAY.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\AZcDTHh.exe
  C:\Windows\System\AZcDTHh.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\FhKPDou.exe
  C:\Windows\System\FhKPDou.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\RPPOpPU.exe
  C:\Windows\System\RPPOpPU.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\OMDIfmO.exe
  C:\Windows\System\OMDIfmO.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\BaHmVmj.exe
  C:\Windows\System\BaHmVmj.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\pDjOyBx.exe
  C:\Windows\System\pDjOyBx.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ymEpTGf.exe
  C:\Windows\System\ymEpTGf.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\GZElsSg.exe
  C:\Windows\System\GZElsSg.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\ligsjOs.exe
  C:\Windows\System\ligsjOs.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\hywHeJA.exe
  C:\Windows\System\hywHeJA.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\ohfPTWU.exe
  C:\Windows\System\ohfPTWU.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\FeezDgA.exe
  C:\Windows\System\FeezDgA.exe
  2⤵
  PID:1752
- C:\Windows\System\VCerLMv.exe
  C:\Windows\System\VCerLMv.exe
  2⤵
  PID:2092
- C:\Windows\System\mEVQFyB.exe
  C:\Windows\System\mEVQFyB.exe
  2⤵
  PID:2072
- C:\Windows\System\SxdFBLe.exe
  C:\Windows\System\SxdFBLe.exe
  2⤵
  PID:2872
- C:\Windows\System\Puuaaxy.exe
  C:\Windows\System\Puuaaxy.exe
  2⤵
  PID:2868
- C:\Windows\System\cyhQbXr.exe
  C:\Windows\System\cyhQbXr.exe
  2⤵
  PID:1900
- C:\Windows\System\UxCrHIL.exe
  C:\Windows\System\UxCrHIL.exe
  2⤵
  PID:1240
- C:\Windows\System\HjlxsOd.exe
  C:\Windows\System\HjlxsOd.exe
  2⤵
  PID:1536
- C:\Windows\System\ePDyifG.exe
  C:\Windows\System\ePDyifG.exe
  2⤵
  PID:1096
- C:\Windows\System\sxAYGfx.exe
  C:\Windows\System\sxAYGfx.exe
  2⤵
  PID:832
- C:\Windows\System\tLJlhgD.exe
  C:\Windows\System\tLJlhgD.exe
  2⤵
  PID:764
- C:\Windows\System\AtXIjgr.exe
  C:\Windows\System\AtXIjgr.exe
  2⤵
  PID:880
- C:\Windows\System\mpchTsu.exe
  C:\Windows\System\mpchTsu.exe
  2⤵
  PID:2224
- C:\Windows\System\InPkqUH.exe
  C:\Windows\System\InPkqUH.exe
  2⤵
  PID:576
- C:\Windows\System\ZkIMjVA.exe
  C:\Windows\System\ZkIMjVA.exe
  2⤵
  PID:2008
- C:\Windows\System\RsBqpcv.exe
  C:\Windows\System\RsBqpcv.exe
  2⤵
  PID:836
- C:\Windows\System\gUkHgrz.exe
  C:\Windows\System\gUkHgrz.exe
  2⤵
  PID:1824
- C:\Windows\System\yKupaST.exe
  C:\Windows\System\yKupaST.exe
  2⤵
  PID:2532
- C:\Windows\System\npAoKtY.exe
  C:\Windows\System\npAoKtY.exe
  2⤵
  PID:2380
- C:\Windows\System\MPKoCOr.exe
  C:\Windows\System\MPKoCOr.exe
  2⤵
  PID:2692
- C:\Windows\System\tCyxZep.exe
  C:\Windows\System\tCyxZep.exe
  2⤵
  PID:2700
- C:\Windows\System\bYQvFpr.exe
  C:\Windows\System\bYQvFpr.exe
  2⤵
  PID:2764
- C:\Windows\System\cRDCXZW.exe
  C:\Windows\System\cRDCXZW.exe
  2⤵
  PID:1624
- C:\Windows\System\mUJhOkK.exe
  C:\Windows\System\mUJhOkK.exe
  2⤵
  PID:1396
- C:\Windows\System\nUxQVTx.exe
  C:\Windows\System\nUxQVTx.exe
  2⤵
  PID:2828
- C:\Windows\System\frZeWVZ.exe
  C:\Windows\System\frZeWVZ.exe
  2⤵
  PID:2012
- C:\Windows\System\ZYadUzq.exe
  C:\Windows\System\ZYadUzq.exe
  2⤵
  PID:1156
- C:\Windows\System\eXvSbKd.exe
  C:\Windows\System\eXvSbKd.exe
  2⤵
  PID:2412
- C:\Windows\System\RJQcgRf.exe
  C:\Windows\System\RJQcgRf.exe
  2⤵
  PID:1984
- C:\Windows\System\xdiTUMX.exe
  C:\Windows\System\xdiTUMX.exe
  2⤵
  PID:904
- C:\Windows\System\ccnDEfH.exe
  C:\Windows\System\ccnDEfH.exe
  2⤵
  PID:1964
- C:\Windows\System\bAHOFqM.exe
  C:\Windows\System\bAHOFqM.exe
  2⤵
  PID:1168
- C:\Windows\System\OHrbvhU.exe
  C:\Windows\System\OHrbvhU.exe
  2⤵
  PID:1812
- C:\Windows\System\piBkFMv.exe
  C:\Windows\System\piBkFMv.exe
  2⤵
  PID:712
- C:\Windows\System\JsoWuBr.exe
  C:\Windows\System\JsoWuBr.exe
  2⤵
  PID:1556
- C:\Windows\System\Pjyhorc.exe
  C:\Windows\System\Pjyhorc.exe
  2⤵
  PID:2104
- C:\Windows\System\iXPpBzX.exe
  C:\Windows\System\iXPpBzX.exe
  2⤵
  PID:1392
- C:\Windows\System\GDYEQtt.exe
  C:\Windows\System\GDYEQtt.exe
  2⤵
  PID:2252
- C:\Windows\System\xfkAoCV.exe
  C:\Windows\System\xfkAoCV.exe
  2⤵
  PID:1580
- C:\Windows\System\lHBftEe.exe
  C:\Windows\System\lHBftEe.exe
  2⤵
  PID:2456
- C:\Windows\System\xVWWtpP.exe
  C:\Windows\System\xVWWtpP.exe
  2⤵
  PID:1600
- C:\Windows\System\XaMOUxz.exe
  C:\Windows\System\XaMOUxz.exe
  2⤵
  PID:3032
- C:\Windows\System\gmULVbZ.exe
  C:\Windows\System\gmULVbZ.exe
  2⤵
  PID:2776
- C:\Windows\System\saxobfF.exe
  C:\Windows\System\saxobfF.exe
  2⤵
  PID:1512
- C:\Windows\System\DFrRdai.exe
  C:\Windows\System\DFrRdai.exe
  2⤵
  PID:1888
- C:\Windows\System\bLUOyti.exe
  C:\Windows\System\bLUOyti.exe
  2⤵
  PID:2664
- C:\Windows\System\yGfHOSl.exe
  C:\Windows\System\yGfHOSl.exe
  2⤵
  PID:3048
- C:\Windows\System\YzqZbTt.exe
  C:\Windows\System\YzqZbTt.exe
  2⤵
  PID:560
- C:\Windows\System\VbcRMUQ.exe
  C:\Windows\System\VbcRMUQ.exe
  2⤵
  PID:2792
- C:\Windows\System\JkSwYax.exe
  C:\Windows\System\JkSwYax.exe
  2⤵
  PID:1640
- C:\Windows\System\nbRJnNx.exe
  C:\Windows\System\nbRJnNx.exe
  2⤵
  PID:1960
- C:\Windows\System\LdDWiMu.exe
  C:\Windows\System\LdDWiMu.exe
  2⤵
  PID:756
- C:\Windows\System\npLHzRv.exe
  C:\Windows\System\npLHzRv.exe
  2⤵
  PID:1088
- C:\Windows\System\hLfpVoO.exe
  C:\Windows\System\hLfpVoO.exe
  2⤵
  PID:1436
- C:\Windows\System\KkqnQLl.exe
  C:\Windows\System\KkqnQLl.exe
  2⤵
  PID:1380
- C:\Windows\System\goSdGZh.exe
  C:\Windows\System\goSdGZh.exe
  2⤵
  PID:2924
- C:\Windows\System\hKamaiV.exe
  C:\Windows\System\hKamaiV.exe
  2⤵
  PID:1544
- C:\Windows\System\MqsiBLE.exe
  C:\Windows\System\MqsiBLE.exe
  2⤵
  PID:1068
- C:\Windows\System\uUgBnCJ.exe
  C:\Windows\System\uUgBnCJ.exe
  2⤵
  PID:1884
- C:\Windows\System\RfbMZPu.exe
  C:\Windows\System\RfbMZPu.exe
  2⤵
  PID:2840
- C:\Windows\System\KyIphrJ.exe
  C:\Windows\System\KyIphrJ.exe
  2⤵
  PID:1720
- C:\Windows\System\tWnZfkT.exe
  C:\Windows\System\tWnZfkT.exe
  2⤵
  PID:2856
- C:\Windows\System\mgpjmht.exe
  C:\Windows\System\mgpjmht.exe
  2⤵
  PID:1080
- C:\Windows\System\dlgsqyU.exe
  C:\Windows\System\dlgsqyU.exe
  2⤵
  PID:2728
- C:\Windows\System\kSXjvpT.exe
  C:\Windows\System\kSXjvpT.exe
  2⤵
  PID:932
- C:\Windows\System\EOuCizQ.exe
  C:\Windows\System\EOuCizQ.exe
  2⤵
  PID:2812
- C:\Windows\System\EMWMJYS.exe
  C:\Windows\System\EMWMJYS.exe
  2⤵
  PID:860
- C:\Windows\System\SDjpDeo.exe
  C:\Windows\System\SDjpDeo.exe
  2⤵
  PID:1356
- C:\Windows\System\vaRAGjE.exe
  C:\Windows\System\vaRAGjE.exe
  2⤵
  PID:2520
- C:\Windows\System\GyztUaV.exe
  C:\Windows\System\GyztUaV.exe
  2⤵
  PID:1736
- C:\Windows\System\jDBToOx.exe
  C:\Windows\System\jDBToOx.exe
  2⤵
  PID:2736
- C:\Windows\System\BzisOzl.exe
  C:\Windows\System\BzisOzl.exe
  2⤵
  PID:1144
- C:\Windows\System\rPCvtSU.exe
  C:\Windows\System\rPCvtSU.exe
  2⤵
  PID:1132
- C:\Windows\System\rskoVzj.exe
  C:\Windows\System\rskoVzj.exe
  2⤵
  PID:2024
- C:\Windows\System\rrVQspw.exe
  C:\Windows\System\rrVQspw.exe
  2⤵
  PID:108
- C:\Windows\System\gtebRHI.exe
  C:\Windows\System\gtebRHI.exe
  2⤵
  PID:668
- C:\Windows\System\woJBKUH.exe
  C:\Windows\System\woJBKUH.exe
  2⤵
  PID:2484
- C:\Windows\System\WWmFThN.exe
  C:\Windows\System\WWmFThN.exe
  2⤵
  PID:1564
- C:\Windows\System\HBcfTMH.exe
  C:\Windows\System\HBcfTMH.exe
  2⤵
  PID:2276
- C:\Windows\System\NqPyVOy.exe
  C:\Windows\System\NqPyVOy.exe
  2⤵
  PID:2632
- C:\Windows\System\KvWxhzt.exe
  C:\Windows\System\KvWxhzt.exe
  2⤵
  PID:1272
- C:\Windows\System\vyZlqHm.exe
  C:\Windows\System\vyZlqHm.exe
  2⤵
  PID:488
- C:\Windows\System\xzGUUOt.exe
  C:\Windows\System\xzGUUOt.exe
  2⤵
  PID:3016
- C:\Windows\System\FnWfjPS.exe
  C:\Windows\System\FnWfjPS.exe
  2⤵
  PID:1668
- C:\Windows\System\JoXrkcg.exe
  C:\Windows\System\JoXrkcg.exe
  2⤵
  PID:1980
- C:\Windows\System\PDLkDgJ.exe
  C:\Windows\System\PDLkDgJ.exe
  2⤵
  PID:856
- C:\Windows\System\DfVYDpk.exe
  C:\Windows\System\DfVYDpk.exe
  2⤵
  PID:2732
- C:\Windows\System\VjKygKh.exe
  C:\Windows\System\VjKygKh.exe
  2⤵
  PID:2588
- C:\Windows\System\jxabDkH.exe
  C:\Windows\System\jxabDkH.exe
  2⤵
  PID:2504
- C:\Windows\System\NXsdOnO.exe
  C:\Windows\System\NXsdOnO.exe
  2⤵
  PID:2824
- C:\Windows\System\FdWugqa.exe
  C:\Windows\System\FdWugqa.exe
  2⤵
  PID:1696
- C:\Windows\System\CgZbbfe.exe
  C:\Windows\System\CgZbbfe.exe
  2⤵
  PID:3080
- C:\Windows\System\dEgdSib.exe
  C:\Windows\System\dEgdSib.exe
  2⤵
  PID:3096
- C:\Windows\System\bhfSCaV.exe
  C:\Windows\System\bhfSCaV.exe
  2⤵
  PID:3112
- C:\Windows\System\RDQbhHK.exe
  C:\Windows\System\RDQbhHK.exe
  2⤵
  PID:3128
- C:\Windows\System\jZbuMrU.exe
  C:\Windows\System\jZbuMrU.exe
  2⤵
  PID:3144
- C:\Windows\System\Zwwbzso.exe
  C:\Windows\System\Zwwbzso.exe
  2⤵
  PID:3160
- C:\Windows\System\oANECSm.exe
  C:\Windows\System\oANECSm.exe
  2⤵
  PID:3180
- C:\Windows\System\MKurTPi.exe
  C:\Windows\System\MKurTPi.exe
  2⤵
  PID:3196
- C:\Windows\System\PCsliVr.exe
  C:\Windows\System\PCsliVr.exe
  2⤵
  PID:3212
- C:\Windows\System\EqFJNCS.exe
  C:\Windows\System\EqFJNCS.exe
  2⤵
  PID:3304
- C:\Windows\System\kXmZlWN.exe
  C:\Windows\System\kXmZlWN.exe
  2⤵
  PID:3320
- C:\Windows\System\egCNclm.exe
  C:\Windows\System\egCNclm.exe
  2⤵
  PID:3336
- C:\Windows\System\ftPHdsM.exe
  C:\Windows\System\ftPHdsM.exe
  2⤵
  PID:3352
- C:\Windows\System\TpvpbwI.exe
  C:\Windows\System\TpvpbwI.exe
  2⤵
  PID:3368
- C:\Windows\System\FZOpXKx.exe
  C:\Windows\System\FZOpXKx.exe
  2⤵
  PID:3384
- C:\Windows\System\ljrVURr.exe
  C:\Windows\System\ljrVURr.exe
  2⤵
  PID:3404
- C:\Windows\System\qhqtDmV.exe
  C:\Windows\System\qhqtDmV.exe
  2⤵
  PID:3420
- C:\Windows\System\emtphVK.exe
  C:\Windows\System\emtphVK.exe
  2⤵
  PID:3436
- C:\Windows\System\nxwhJSy.exe
  C:\Windows\System\nxwhJSy.exe
  2⤵
  PID:3452
- C:\Windows\System\nkHKGoZ.exe
  C:\Windows\System\nkHKGoZ.exe
  2⤵
  PID:3468
- C:\Windows\System\yVXAymU.exe
  C:\Windows\System\yVXAymU.exe
  2⤵
  PID:3484
- C:\Windows\System\rMOuxsL.exe
  C:\Windows\System\rMOuxsL.exe
  2⤵
  PID:3500
- C:\Windows\System\aOKEcpG.exe
  C:\Windows\System\aOKEcpG.exe
  2⤵
  PID:3516
- C:\Windows\System\pkUFiNp.exe
  C:\Windows\System\pkUFiNp.exe
  2⤵
  PID:3532
- C:\Windows\System\LmIqjEy.exe
  C:\Windows\System\LmIqjEy.exe
  2⤵
  PID:3548
- C:\Windows\System\xcfEeQj.exe
  C:\Windows\System\xcfEeQj.exe
  2⤵
  PID:3564
- C:\Windows\System\qXZeoNJ.exe
  C:\Windows\System\qXZeoNJ.exe
  2⤵
  PID:3584
- C:\Windows\System\aGhuGbn.exe
  C:\Windows\System\aGhuGbn.exe
  2⤵
  PID:3600
- C:\Windows\System\UmMqSCy.exe
  C:\Windows\System\UmMqSCy.exe
  2⤵
  PID:3616
- C:\Windows\System\Lihvbvz.exe
  C:\Windows\System\Lihvbvz.exe
  2⤵
  PID:3724
- C:\Windows\System\xWyPYKh.exe
  C:\Windows\System\xWyPYKh.exe
  2⤵
  PID:3744
- C:\Windows\System\tqLZyWt.exe
  C:\Windows\System\tqLZyWt.exe
  2⤵
  PID:3760
- C:\Windows\System\TPHLwgO.exe
  C:\Windows\System\TPHLwgO.exe
  2⤵
  PID:3784
- C:\Windows\System\CfNXAmr.exe
  C:\Windows\System\CfNXAmr.exe
  2⤵
  PID:3800
- C:\Windows\System\tlWKUuo.exe
  C:\Windows\System\tlWKUuo.exe
  2⤵
  PID:3824
- C:\Windows\System\GZiLkzN.exe
  C:\Windows\System\GZiLkzN.exe
  2⤵
  PID:3840
- C:\Windows\System\kzbvMkg.exe
  C:\Windows\System\kzbvMkg.exe
  2⤵
  PID:3864
- C:\Windows\System\LBojHmU.exe
  C:\Windows\System\LBojHmU.exe
  2⤵
  PID:3880
- C:\Windows\System\lSXCVVC.exe
  C:\Windows\System\lSXCVVC.exe
  2⤵
  PID:3900
- C:\Windows\System\gUwycqw.exe
  C:\Windows\System\gUwycqw.exe
  2⤵
  PID:3916
- C:\Windows\System\lspZeik.exe
  C:\Windows\System\lspZeik.exe
  2⤵
  PID:3940
- C:\Windows\System\QRmDxoT.exe
  C:\Windows\System\QRmDxoT.exe
  2⤵
  PID:3960
- C:\Windows\System\DwQJCWu.exe
  C:\Windows\System\DwQJCWu.exe
  2⤵
  PID:3980
- C:\Windows\System\Rblazlg.exe
  C:\Windows\System\Rblazlg.exe
  2⤵
  PID:3996
- C:\Windows\System\wXhAAru.exe
  C:\Windows\System\wXhAAru.exe
  2⤵
  PID:4016
- C:\Windows\System\bqFkanc.exe
  C:\Windows\System\bqFkanc.exe
  2⤵
  PID:4040
- C:\Windows\System\UfNWIWR.exe
  C:\Windows\System\UfNWIWR.exe
  2⤵
  PID:4060
- C:\Windows\System\SEzhytK.exe
  C:\Windows\System\SEzhytK.exe
  2⤵
  PID:4080
- C:\Windows\System\MbaGMMf.exe
  C:\Windows\System\MbaGMMf.exe
  2⤵
  PID:1288
- C:\Windows\System\kzkazSZ.exe
  C:\Windows\System\kzkazSZ.exe
  2⤵
  PID:2988
- C:\Windows\System\LEAKwiM.exe
  C:\Windows\System\LEAKwiM.exe
  2⤵
  PID:2032
- C:\Windows\System\UMAiEMo.exe
  C:\Windows\System\UMAiEMo.exe
  2⤵
  PID:3120
- C:\Windows\System\qgHXgGp.exe
  C:\Windows\System\qgHXgGp.exe
  2⤵
  PID:3220
- C:\Windows\System\oBHKbhu.exe
  C:\Windows\System\oBHKbhu.exe
  2⤵
  PID:3240
- C:\Windows\System\AXDHAdx.exe
  C:\Windows\System\AXDHAdx.exe
  2⤵
  PID:2524
- C:\Windows\System\XCzddmv.exe
  C:\Windows\System\XCzddmv.exe
  2⤵
  PID:3064
- C:\Windows\System\JJDWqhb.exe
  C:\Windows\System\JJDWqhb.exe
  2⤵
  PID:2576
- C:\Windows\System\DPrCCEo.exe
  C:\Windows\System\DPrCCEo.exe
  2⤵
  PID:616
- C:\Windows\System\PkaKXkG.exe
  C:\Windows\System\PkaKXkG.exe
  2⤵
  PID:3264
- C:\Windows\System\wADVnNY.exe
  C:\Windows\System\wADVnNY.exe
  2⤵
  PID:3172
- C:\Windows\System\GMYMqKU.exe
  C:\Windows\System\GMYMqKU.exe
  2⤵
  PID:3292
- C:\Windows\System\fNrDOBQ.exe
  C:\Windows\System\fNrDOBQ.exe
  2⤵
  PID:3332
- C:\Windows\System\wLaNRcb.exe
  C:\Windows\System\wLaNRcb.exe
  2⤵
  PID:3252
- C:\Windows\System\zHoBbnb.exe
  C:\Windows\System\zHoBbnb.exe
  2⤵
  PID:3460
- C:\Windows\System\KrygZgy.exe
  C:\Windows\System\KrygZgy.exe
  2⤵
  PID:3316
- C:\Windows\System\KbHzbMb.exe
  C:\Windows\System\KbHzbMb.exe
  2⤵
  PID:3380
- C:\Windows\System\UnEpaYV.exe
  C:\Windows\System\UnEpaYV.exe
  2⤵
  PID:3528
- C:\Windows\System\NqJWrvj.exe
  C:\Windows\System\NqJWrvj.exe
  2⤵
  PID:3596
- C:\Windows\System\oyCUeXc.exe
  C:\Windows\System\oyCUeXc.exe
  2⤵
  PID:3636
- C:\Windows\System\TYcjsLm.exe
  C:\Windows\System\TYcjsLm.exe
  2⤵
  PID:3660
- C:\Windows\System\JTwxOse.exe
  C:\Windows\System\JTwxOse.exe
  2⤵
  PID:3668
- C:\Windows\System\YFylsEK.exe
  C:\Windows\System\YFylsEK.exe
  2⤵
  PID:3508
- C:\Windows\System\lQapSTs.exe
  C:\Windows\System\lQapSTs.exe
  2⤵
  PID:3572
- C:\Windows\System\vbVnwso.exe
  C:\Windows\System\vbVnwso.exe
  2⤵
  PID:3612
- C:\Windows\System\ZjjBjQy.exe
  C:\Windows\System\ZjjBjQy.exe
  2⤵
  PID:3696
- C:\Windows\System\BsgyVAg.exe
  C:\Windows\System\BsgyVAg.exe
  2⤵
  PID:3680
- C:\Windows\System\fnbcZHj.exe
  C:\Windows\System\fnbcZHj.exe
  2⤵
  PID:3736
- C:\Windows\System\NEoInVn.exe
  C:\Windows\System\NEoInVn.exe
  2⤵
  PID:3776
- C:\Windows\System\kFzVsHv.exe
  C:\Windows\System\kFzVsHv.exe
  2⤵
  PID:3808
- C:\Windows\System\LoMEquM.exe
  C:\Windows\System\LoMEquM.exe
  2⤵
  PID:3812
- C:\Windows\System\nvsWVPr.exe
  C:\Windows\System\nvsWVPr.exe
  2⤵
  PID:3856
- C:\Windows\System\mXxfoGG.exe
  C:\Windows\System\mXxfoGG.exe
  2⤵
  PID:3876
- C:\Windows\System\SaBINHt.exe
  C:\Windows\System\SaBINHt.exe
  2⤵
  PID:3924
- C:\Windows\System\oUPEwOv.exe
  C:\Windows\System\oUPEwOv.exe
  2⤵
  PID:3928
- C:\Windows\System\SEWAhzv.exe
  C:\Windows\System\SEWAhzv.exe
  2⤵
  PID:3956
- C:\Windows\System\YkvLrzx.exe
  C:\Windows\System\YkvLrzx.exe
  2⤵
  PID:4004
- C:\Windows\System\UFobAXI.exe
  C:\Windows\System\UFobAXI.exe
  2⤵
  PID:4008
- C:\Windows\System\kxWrpQI.exe
  C:\Windows\System\kxWrpQI.exe
  2⤵
  PID:4048
- C:\Windows\System\ChhIrIB.exe
  C:\Windows\System\ChhIrIB.exe
  2⤵
  PID:4076
- C:\Windows\System\dzWCjhL.exe
  C:\Windows\System\dzWCjhL.exe
  2⤵
  PID:4092
- C:\Windows\System\xCkrgTX.exe
  C:\Windows\System\xCkrgTX.exe
  2⤵
  PID:2716
- C:\Windows\System\JqZpWTm.exe
  C:\Windows\System\JqZpWTm.exe
  2⤵
  PID:3092
- C:\Windows\System\MhvdVuu.exe
  C:\Windows\System\MhvdVuu.exe
  2⤵
  PID:3228
- C:\Windows\System\UNYswdf.exe
  C:\Windows\System\UNYswdf.exe
  2⤵
  PID:3140
- C:\Windows\System\KLjyvVy.exe
  C:\Windows\System\KLjyvVy.exe
  2⤵
  PID:2088
- C:\Windows\System\xgVDlxi.exe
  C:\Windows\System\xgVDlxi.exe
  2⤵
  PID:1828
- C:\Windows\System\sabRcpl.exe
  C:\Windows\System\sabRcpl.exe
  2⤵
  PID:1684
- C:\Windows\System\MQpGrAd.exe
  C:\Windows\System\MQpGrAd.exe
  2⤵
  PID:3108
- C:\Windows\System\AaJKbBD.exe
  C:\Windows\System\AaJKbBD.exe
  2⤵
  PID:3280
- C:\Windows\System\eFXeLdP.exe
  C:\Windows\System\eFXeLdP.exe
  2⤵
  PID:3328
- C:\Windows\System\EZFEiJs.exe
  C:\Windows\System\EZFEiJs.exe
  2⤵
  PID:3268
- C:\Windows\System\tyhzJIq.exe
  C:\Windows\System\tyhzJIq.exe
  2⤵
  PID:3756
- C:\Windows\System\SkHsqaD.exe
  C:\Windows\System\SkHsqaD.exe
  2⤵
  PID:3524
- C:\Windows\System\YlqhvpV.exe
  C:\Windows\System\YlqhvpV.exe
  2⤵
  PID:3820
- C:\Windows\System\HPjhOne.exe
  C:\Windows\System\HPjhOne.exe
  2⤵
  PID:3936
- C:\Windows\System\mqBnQnO.exe
  C:\Windows\System\mqBnQnO.exe
  2⤵
  PID:4036
- C:\Windows\System\YQaxVWJ.exe
  C:\Windows\System\YQaxVWJ.exe
  2⤵
  PID:3088
- C:\Windows\System\KaRNnFe.exe
  C:\Windows\System\KaRNnFe.exe
  2⤵
  PID:1204
- C:\Windows\System\owyGKNf.exe
  C:\Windows\System\owyGKNf.exe
  2⤵
  PID:3732
- C:\Windows\System\OsYRwvW.exe
  C:\Windows\System\OsYRwvW.exe
  2⤵
  PID:3544
- C:\Windows\System\KPwuZUA.exe
  C:\Windows\System\KPwuZUA.exe
  2⤵
  PID:3300
- C:\Windows\System\yanrXbb.exe
  C:\Windows\System\yanrXbb.exe
  2⤵
  PID:3560
- C:\Windows\System\rFRAZEM.exe
  C:\Windows\System\rFRAZEM.exe
  2⤵
  PID:1520
- C:\Windows\System\BvhUAPn.exe
  C:\Windows\System\BvhUAPn.exe
  2⤵
  PID:3792
- C:\Windows\System\UoAGnoO.exe
  C:\Windows\System\UoAGnoO.exe
  2⤵
  PID:3892
- C:\Windows\System\EpAkahP.exe
  C:\Windows\System\EpAkahP.exe
  2⤵
  PID:4024
- C:\Windows\System\kMRqeBI.exe
  C:\Windows\System\kMRqeBI.exe
  2⤵
  PID:348
- C:\Windows\System\waBCWvM.exe
  C:\Windows\System\waBCWvM.exe
  2⤵
  PID:628
- C:\Windows\System\PVOGpfd.exe
  C:\Windows\System\PVOGpfd.exe
  2⤵
  PID:3476
- C:\Windows\System\fVJopoM.exe
  C:\Windows\System\fVJopoM.exe
  2⤵
  PID:3704
- C:\Windows\System\XukphIj.exe
  C:\Windows\System\XukphIj.exe
  2⤵
  PID:3152
- C:\Windows\System\VvdTwng.exe
  C:\Windows\System\VvdTwng.exe
  2⤵
  PID:3540
- C:\Windows\System\LBEXrYU.exe
  C:\Windows\System\LBEXrYU.exe
  2⤵
  PID:3676
- C:\Windows\System\ZAhudtr.exe
  C:\Windows\System\ZAhudtr.exe
  2⤵
  PID:3968
- C:\Windows\System\jRxLvtW.exe
  C:\Windows\System\jRxLvtW.exe
  2⤵
  PID:2616
- C:\Windows\System\WDYVybH.exe
  C:\Windows\System\WDYVybH.exe
  2⤵
  PID:3312
- C:\Windows\System\spiPLYl.exe
  C:\Windows\System\spiPLYl.exe
  2⤵
  PID:1608
- C:\Windows\System\lWVyyvn.exe
  C:\Windows\System\lWVyyvn.exe
  2⤵
  PID:3644
- C:\Windows\System\gFAEXKv.exe
  C:\Windows\System\gFAEXKv.exe
  2⤵
  PID:3896
- C:\Windows\System\IPYDQSn.exe
  C:\Windows\System\IPYDQSn.exe
  2⤵
  PID:1944
- C:\Windows\System\sgJrHXj.exe
  C:\Windows\System\sgJrHXj.exe
  2⤵
  PID:1192
- C:\Windows\System\sTmRnbm.exe
  C:\Windows\System\sTmRnbm.exe
  2⤵
  PID:1208
- C:\Windows\System\vROTruU.exe
  C:\Windows\System\vROTruU.exe
  2⤵
  PID:3412
- C:\Windows\System\cbFvmXu.exe
  C:\Windows\System\cbFvmXu.exe
  2⤵
  PID:1524
- C:\Windows\System\TPRkdgp.exe
  C:\Windows\System\TPRkdgp.exe
  2⤵
  PID:3256
- C:\Windows\System\ZlIasrZ.exe
  C:\Windows\System\ZlIasrZ.exe
  2⤵
  PID:1244
- C:\Windows\System\TIYNzBr.exe
  C:\Windows\System\TIYNzBr.exe
  2⤵
  PID:2528
- C:\Windows\System\srHvuJX.exe
  C:\Windows\System\srHvuJX.exe
  2⤵
  PID:3276
- C:\Windows\System\oYNNXrj.exe
  C:\Windows\System\oYNNXrj.exe
  2⤵
  PID:3136
- C:\Windows\System\QqqvnkB.exe
  C:\Windows\System\QqqvnkB.exe
  2⤵
  PID:3448
- C:\Windows\System\sSavjJG.exe
  C:\Windows\System\sSavjJG.exe
  2⤵
  PID:3348
- C:\Windows\System\tthTPWF.exe
  C:\Windows\System\tthTPWF.exe
  2⤵
  PID:1528
- C:\Windows\System\pRhvFKq.exe
  C:\Windows\System\pRhvFKq.exe
  2⤵
  PID:3656
- C:\Windows\System\SSbZTme.exe
  C:\Windows\System\SSbZTme.exe
  2⤵
  PID:2744
- C:\Windows\System\zAmCkUL.exe
  C:\Windows\System\zAmCkUL.exe
  2⤵
  PID:4068
- C:\Windows\System\EFLWizG.exe
  C:\Windows\System\EFLWizG.exe
  2⤵
  PID:4104
- C:\Windows\System\QSDmaSm.exe
  C:\Windows\System\QSDmaSm.exe
  2⤵
  PID:4120
- C:\Windows\System\wHXyKYU.exe
  C:\Windows\System\wHXyKYU.exe
  2⤵
  PID:4144
- C:\Windows\System\fTrKbfH.exe
  C:\Windows\System\fTrKbfH.exe
  2⤵
  PID:4172
- C:\Windows\System\UexDWAE.exe
  C:\Windows\System\UexDWAE.exe
  2⤵
  PID:4192
- C:\Windows\System\ApxzLIR.exe
  C:\Windows\System\ApxzLIR.exe
  2⤵
  PID:4212
- C:\Windows\System\wmJTWmH.exe
  C:\Windows\System\wmJTWmH.exe
  2⤵
  PID:4232
- C:\Windows\System\pzKzfJC.exe
  C:\Windows\System\pzKzfJC.exe
  2⤵
  PID:4248
- C:\Windows\System\yTHWEey.exe
  C:\Windows\System\yTHWEey.exe
  2⤵
  PID:4268
- C:\Windows\System\MgfQBqG.exe
  C:\Windows\System\MgfQBqG.exe
  2⤵
  PID:4288
- C:\Windows\System\IxxcOcb.exe
  C:\Windows\System\IxxcOcb.exe
  2⤵
  PID:4304
- C:\Windows\System\XgdpAEX.exe
  C:\Windows\System\XgdpAEX.exe
  2⤵
  PID:4320
- C:\Windows\System\wnnhnzV.exe
  C:\Windows\System\wnnhnzV.exe
  2⤵
  PID:4344
- C:\Windows\System\xIOPkpj.exe
  C:\Windows\System\xIOPkpj.exe
  2⤵
  PID:4360
- C:\Windows\System\nzVbOqv.exe
  C:\Windows\System\nzVbOqv.exe
  2⤵
  PID:4384
- C:\Windows\System\cDygRHe.exe
  C:\Windows\System\cDygRHe.exe
  2⤵
  PID:4400
- C:\Windows\System\jXjzdZL.exe
  C:\Windows\System\jXjzdZL.exe
  2⤵
  PID:4416
- C:\Windows\System\NuEvOUE.exe
  C:\Windows\System\NuEvOUE.exe
  2⤵
  PID:4432
- C:\Windows\System\RUQRjUT.exe
  C:\Windows\System\RUQRjUT.exe
  2⤵
  PID:4448
- C:\Windows\System\lrJWOhB.exe
  C:\Windows\System\lrJWOhB.exe
  2⤵
  PID:4464
- C:\Windows\System\SCaOTCj.exe
  C:\Windows\System\SCaOTCj.exe
  2⤵
  PID:4480
- C:\Windows\System\BZNkrxJ.exe
  C:\Windows\System\BZNkrxJ.exe
  2⤵
  PID:4496
- C:\Windows\System\uLhCscy.exe
  C:\Windows\System\uLhCscy.exe
  2⤵
  PID:4516
- C:\Windows\System\YZhUQYm.exe
  C:\Windows\System\YZhUQYm.exe
  2⤵
  PID:4532
- C:\Windows\System\hzzqNpE.exe
  C:\Windows\System\hzzqNpE.exe
  2⤵
  PID:4548
- C:\Windows\System\zjMllbW.exe
  C:\Windows\System\zjMllbW.exe
  2⤵
  PID:4564
- C:\Windows\System\nUhgDxy.exe
  C:\Windows\System\nUhgDxy.exe
  2⤵
  PID:4580
- C:\Windows\System\xxRiiiw.exe
  C:\Windows\System\xxRiiiw.exe
  2⤵
  PID:4660
- C:\Windows\System\cJXqDJT.exe
  C:\Windows\System\cJXqDJT.exe
  2⤵
  PID:4676
- C:\Windows\System\ZkGrZkC.exe
  C:\Windows\System\ZkGrZkC.exe
  2⤵
  PID:4692
- C:\Windows\System\YAlXoIh.exe
  C:\Windows\System\YAlXoIh.exe
  2⤵
  PID:4708
- C:\Windows\System\tNhiiib.exe
  C:\Windows\System\tNhiiib.exe
  2⤵
  PID:4724
- C:\Windows\System\jvwJrqB.exe
  C:\Windows\System\jvwJrqB.exe
  2⤵
  PID:4740
- C:\Windows\System\nzvuSjB.exe
  C:\Windows\System\nzvuSjB.exe
  2⤵
  PID:4756
- C:\Windows\System\UNkmRuZ.exe
  C:\Windows\System\UNkmRuZ.exe
  2⤵
  PID:4772
- C:\Windows\System\bvpXber.exe
  C:\Windows\System\bvpXber.exe
  2⤵
  PID:4788
- C:\Windows\System\kOsmBew.exe
  C:\Windows\System\kOsmBew.exe
  2⤵
  PID:4804
- C:\Windows\System\bnIPOzo.exe
  C:\Windows\System\bnIPOzo.exe
  2⤵
  PID:4820
- C:\Windows\System\IdaEMZC.exe
  C:\Windows\System\IdaEMZC.exe
  2⤵
  PID:4836
- C:\Windows\System\ZpJferh.exe
  C:\Windows\System\ZpJferh.exe
  2⤵
  PID:4852
- C:\Windows\System\UXpKgRj.exe
  C:\Windows\System\UXpKgRj.exe
  2⤵
  PID:4868
- C:\Windows\System\NEXkIJZ.exe
  C:\Windows\System\NEXkIJZ.exe
  2⤵
  PID:4884
- C:\Windows\System\pizmwDj.exe
  C:\Windows\System\pizmwDj.exe
  2⤵
  PID:4904
- C:\Windows\System\miUITuC.exe
  C:\Windows\System\miUITuC.exe
  2⤵
  PID:4920
- C:\Windows\System\Mgmkjpw.exe
  C:\Windows\System\Mgmkjpw.exe
  2⤵
  PID:4936
- C:\Windows\System\JKkmUKC.exe
  C:\Windows\System\JKkmUKC.exe
  2⤵
  PID:4952
- C:\Windows\System\ppowrRg.exe
  C:\Windows\System\ppowrRg.exe
  2⤵
  PID:4988
- C:\Windows\System\yVOQTBX.exe
  C:\Windows\System\yVOQTBX.exe
  2⤵
  PID:5072
- C:\Windows\System\YLfhvmv.exe
  C:\Windows\System\YLfhvmv.exe
  2⤵
  PID:5088
- C:\Windows\System\TraxRjb.exe
  C:\Windows\System\TraxRjb.exe
  2⤵
  PID:5104
- C:\Windows\System\nTnwnUX.exe
  C:\Windows\System\nTnwnUX.exe
  2⤵
  PID:3848
- C:\Windows\System\SwNNzDh.exe
  C:\Windows\System\SwNNzDh.exe
  2⤵
  PID:3772
- C:\Windows\System\JIbStsY.exe
  C:\Windows\System\JIbStsY.exe
  2⤵
  PID:4140
- C:\Windows\System\WjEMUWF.exe
  C:\Windows\System\WjEMUWF.exe
  2⤵
  PID:4164
- C:\Windows\System\Xlwnjcp.exe
  C:\Windows\System\Xlwnjcp.exe
  2⤵
  PID:4188
- C:\Windows\System\AHKsxJI.exe
  C:\Windows\System\AHKsxJI.exe
  2⤵
  PID:4204
- C:\Windows\System\qZwInIW.exe
  C:\Windows\System\qZwInIW.exe
  2⤵
  PID:4240
- C:\Windows\System\LtXlUSt.exe
  C:\Windows\System\LtXlUSt.exe
  2⤵
  PID:4256
- C:\Windows\System\uHgHbok.exe
  C:\Windows\System\uHgHbok.exe
  2⤵
  PID:4316
- C:\Windows\System\OCWQBFh.exe
  C:\Windows\System\OCWQBFh.exe
  2⤵
  PID:2796
- C:\Windows\System\loDxlsU.exe
  C:\Windows\System\loDxlsU.exe
  2⤵
  PID:4488
- C:\Windows\System\yuufJMg.exe
  C:\Windows\System\yuufJMg.exe
  2⤵
  PID:4328
- C:\Windows\System\mUMAjEk.exe
  C:\Windows\System\mUMAjEk.exe
  2⤵
  PID:4368
- C:\Windows\System\bXEuwSB.exe
  C:\Windows\System\bXEuwSB.exe
  2⤵
  PID:4476
- C:\Windows\System\fwkjTZe.exe
  C:\Windows\System\fwkjTZe.exe
  2⤵
  PID:4456
- C:\Windows\System\RQEfchU.exe
  C:\Windows\System\RQEfchU.exe
  2⤵
  PID:4440
- C:\Windows\System\ngLrGUS.exe
  C:\Windows\System\ngLrGUS.exe
  2⤵
  PID:4616
- C:\Windows\System\wjGGwme.exe
  C:\Windows\System\wjGGwme.exe
  2⤵
  PID:4632
- C:\Windows\System\sSofnpZ.exe
  C:\Windows\System\sSofnpZ.exe
  2⤵
  PID:4648
- C:\Windows\System\QFjRpvX.exe
  C:\Windows\System\QFjRpvX.exe
  2⤵
  PID:4684
- C:\Windows\System\SdnQnqP.exe
  C:\Windows\System\SdnQnqP.exe
  2⤵
  PID:4720
- C:\Windows\System\uobpouE.exe
  C:\Windows\System\uobpouE.exe
  2⤵
  PID:4736
- C:\Windows\System\wQCYgkO.exe
  C:\Windows\System\wQCYgkO.exe
  2⤵
  PID:4828
- C:\Windows\System\WAWFnRw.exe
  C:\Windows\System\WAWFnRw.exe
  2⤵
  PID:4892
- C:\Windows\System\SyVmEej.exe
  C:\Windows\System\SyVmEej.exe
  2⤵
  PID:4916
- C:\Windows\System\GwtHlpl.exe
  C:\Windows\System\GwtHlpl.exe
  2⤵
  PID:4960
- C:\Windows\System\wrbBPmB.exe
  C:\Windows\System\wrbBPmB.exe
  2⤵
  PID:4968
- C:\Windows\System\JzjFphJ.exe
  C:\Windows\System\JzjFphJ.exe
  2⤵
  PID:4996
- C:\Windows\System\NLeETiI.exe
  C:\Windows\System\NLeETiI.exe
  2⤵
  PID:5008
- C:\Windows\System\vXGdPyQ.exe
  C:\Windows\System\vXGdPyQ.exe
  2⤵
  PID:5024
- C:\Windows\System\fRHxCVF.exe
  C:\Windows\System\fRHxCVF.exe
  2⤵
  PID:5040
- C:\Windows\System\elHCPAL.exe
  C:\Windows\System\elHCPAL.exe
  2⤵
  PID:5056
- C:\Windows\System\edazgUV.exe
  C:\Windows\System\edazgUV.exe
  2⤵
  PID:5112
- C:\Windows\System\DuTaqTd.exe
  C:\Windows\System\DuTaqTd.exe
  2⤵
  PID:4128
- C:\Windows\System\ekzZzte.exe
  C:\Windows\System\ekzZzte.exe
  2⤵
  PID:4312
- C:\Windows\System\kAVNXfG.exe
  C:\Windows\System\kAVNXfG.exe
  2⤵
  PID:4180
- C:\Windows\System\oWuRkFM.exe
  C:\Windows\System\oWuRkFM.exe
  2⤵
  PID:4528
- C:\Windows\System\NJHHDdN.exe
  C:\Windows\System\NJHHDdN.exe
  2⤵
  PID:4208
- C:\Windows\System\WgSKyuP.exe
  C:\Windows\System\WgSKyuP.exe
  2⤵
  PID:3188
- C:\Windows\System\SZGArYu.exe
  C:\Windows\System\SZGArYu.exe
  2⤵
  PID:4284
- C:\Windows\System\WspGdOk.exe
  C:\Windows\System\WspGdOk.exe
  2⤵
  PID:4300
- C:\Windows\System\oznvVFh.exe
  C:\Windows\System\oznvVFh.exe
  2⤵
  PID:4408
- C:\Windows\System\psrmPXB.exe
  C:\Windows\System\psrmPXB.exe
  2⤵
  PID:4512
- C:\Windows\System\VdZdpjQ.exe
  C:\Windows\System\VdZdpjQ.exe
  2⤵
  PID:4668
- C:\Windows\System\XrpZYzb.exe
  C:\Windows\System\XrpZYzb.exe
  2⤵
  PID:412
- C:\Windows\System\KrNoswd.exe
  C:\Windows\System\KrNoswd.exe
  2⤵
  PID:4816
- C:\Windows\System\KEineMI.exe
  C:\Windows\System\KEineMI.exe
  2⤵
  PID:4608
- C:\Windows\System\aoiyXaX.exe
  C:\Windows\System\aoiyXaX.exe
  2⤵
  PID:4600
- C:\Windows\System\uoQfJTw.exe
  C:\Windows\System\uoQfJTw.exe
  2⤵
  PID:4572
- C:\Windows\System\bcHagaP.exe
  C:\Windows\System\bcHagaP.exe
  2⤵
  PID:4768
- C:\Windows\System\TsWKDlD.exe
  C:\Windows\System\TsWKDlD.exe
  2⤵
  PID:4544
- C:\Windows\System\QxjeBJw.exe
  C:\Windows\System\QxjeBJw.exe
  2⤵
  PID:5032
- C:\Windows\System\upRrfFL.exe
  C:\Windows\System\upRrfFL.exe
  2⤵
  PID:5084
- C:\Windows\System\HsyRsPV.exe
  C:\Windows\System\HsyRsPV.exe
  2⤵
  PID:4424
- C:\Windows\System\pYbCTFD.exe
  C:\Windows\System\pYbCTFD.exe
  2⤵
  PID:4356
- C:\Windows\System\mBGkjjU.exe
  C:\Windows\System\mBGkjjU.exe
  2⤵
  PID:4592
- C:\Windows\System\FPhrRhC.exe
  C:\Windows\System\FPhrRhC.exe
  2⤵
  PID:4636
- C:\Windows\System\GYlvyul.exe
  C:\Windows\System\GYlvyul.exe
  2⤵
  PID:4864
- C:\Windows\System\hYruKof.exe
  C:\Windows\System\hYruKof.exe
  2⤵
  PID:4972
- C:\Windows\System\nxonEWv.exe
  C:\Windows\System\nxonEWv.exe
  2⤵
  PID:3496
- C:\Windows\System\mJZYfbx.exe
  C:\Windows\System\mJZYfbx.exe
  2⤵
  PID:4336
- C:\Windows\System\jVokAgZ.exe
  C:\Windows\System\jVokAgZ.exe
  2⤵
  PID:4380
- C:\Windows\System\QtUcCVz.exe
  C:\Windows\System\QtUcCVz.exe
  2⤵
  PID:4784
- C:\Windows\System\uRDqUzF.exe
  C:\Windows\System\uRDqUzF.exe
  2⤵
  PID:4560
- C:\Windows\System\UFkeBOO.exe
  C:\Windows\System\UFkeBOO.exe
  2⤵
  PID:4748
- C:\Windows\System\TDObnGp.exe
  C:\Windows\System\TDObnGp.exe
  2⤵
  PID:5000
- C:\Windows\System\UwAdZKY.exe
  C:\Windows\System\UwAdZKY.exe
  2⤵
  PID:4116
- C:\Windows\System\bopilwh.exe
  C:\Windows\System\bopilwh.exe
  2⤵
  PID:4928
- C:\Windows\System\eqCvRch.exe
  C:\Windows\System\eqCvRch.exe
  2⤵
  PID:5132
- C:\Windows\System\EdwnEBg.exe
  C:\Windows\System\EdwnEBg.exe
  2⤵
  PID:5148
- C:\Windows\System\ZjSznax.exe
  C:\Windows\System\ZjSznax.exe
  2⤵
  PID:5164
- C:\Windows\System\ugxgiRx.exe
  C:\Windows\System\ugxgiRx.exe
  2⤵
  PID:5184
- C:\Windows\System\jKCPruS.exe
  C:\Windows\System\jKCPruS.exe
  2⤵
  PID:5200
- C:\Windows\System\tywuOXI.exe
  C:\Windows\System\tywuOXI.exe
  2⤵
  PID:5216
- C:\Windows\System\DLgLXaS.exe
  C:\Windows\System\DLgLXaS.exe
  2⤵
  PID:5236
- C:\Windows\System\VQoNQUL.exe
  C:\Windows\System\VQoNQUL.exe
  2⤵
  PID:5252
- C:\Windows\System\TLMdCRu.exe
  C:\Windows\System\TLMdCRu.exe
  2⤵
  PID:5268
- C:\Windows\System\RVeRZwx.exe
  C:\Windows\System\RVeRZwx.exe
  2⤵
  PID:5284
- C:\Windows\System\ajLigfm.exe
  C:\Windows\System\ajLigfm.exe
  2⤵
  PID:5300
- C:\Windows\System\JANtXEt.exe
  C:\Windows\System\JANtXEt.exe
  2⤵
  PID:5316
- C:\Windows\System\xgodHgj.exe
  C:\Windows\System\xgodHgj.exe
  2⤵
  PID:5332
- C:\Windows\System\DIMDkvy.exe
  C:\Windows\System\DIMDkvy.exe
  2⤵
  PID:5348
- C:\Windows\System\KaaLImJ.exe
  C:\Windows\System\KaaLImJ.exe
  2⤵
  PID:5364
- C:\Windows\System\OigAKNt.exe
  C:\Windows\System\OigAKNt.exe
  2⤵
  PID:5380
- C:\Windows\System\ITTTzVP.exe
  C:\Windows\System\ITTTzVP.exe
  2⤵
  PID:5400
- C:\Windows\System\zQsTuhl.exe
  C:\Windows\System\zQsTuhl.exe
  2⤵
  PID:5416
- C:\Windows\System\bpzrDuO.exe
  C:\Windows\System\bpzrDuO.exe
  2⤵
  PID:5432
- C:\Windows\System\mbZFaRk.exe
  C:\Windows\System\mbZFaRk.exe
  2⤵
  PID:5448
- C:\Windows\System\PnFQjgp.exe
  C:\Windows\System\PnFQjgp.exe
  2⤵
  PID:5464
- C:\Windows\System\SYbbGca.exe
  C:\Windows\System\SYbbGca.exe
  2⤵
  PID:5480
- C:\Windows\System\qKKBMxH.exe
  C:\Windows\System\qKKBMxH.exe
  2⤵
  PID:5496
- C:\Windows\System\NBiBJfy.exe
  C:\Windows\System\NBiBJfy.exe
  2⤵
  PID:5512
- C:\Windows\System\cPyDDMN.exe
  C:\Windows\System\cPyDDMN.exe
  2⤵
  PID:5528
- C:\Windows\System\VWyjyaB.exe
  C:\Windows\System\VWyjyaB.exe
  2⤵
  PID:5544
- C:\Windows\System\QVxNWro.exe
  C:\Windows\System\QVxNWro.exe
  2⤵
  PID:5564
- C:\Windows\System\uvKmEJh.exe
  C:\Windows\System\uvKmEJh.exe
  2⤵
  PID:5580
- C:\Windows\System\jELhKkt.exe
  C:\Windows\System\jELhKkt.exe
  2⤵
  PID:5596
- C:\Windows\System\yCjkBUx.exe
  C:\Windows\System\yCjkBUx.exe
  2⤵
  PID:5612
- C:\Windows\System\plVoEdT.exe
  C:\Windows\System\plVoEdT.exe
  2⤵
  PID:5628
- C:\Windows\System\BHsoCsA.exe
  C:\Windows\System\BHsoCsA.exe
  2⤵
  PID:5644
- C:\Windows\System\IJhNQki.exe
  C:\Windows\System\IJhNQki.exe
  2⤵
  PID:5664
- C:\Windows\System\AwRqKgF.exe
  C:\Windows\System\AwRqKgF.exe
  2⤵
  PID:5680
- C:\Windows\System\nPgLKVv.exe
  C:\Windows\System\nPgLKVv.exe
  2⤵
  PID:5696
- C:\Windows\System\zGgvdyP.exe
  C:\Windows\System\zGgvdyP.exe
  2⤵
  PID:5712
- C:\Windows\System\ZrBoQHU.exe
  C:\Windows\System\ZrBoQHU.exe
  2⤵
  PID:5728
- C:\Windows\System\wSmysDr.exe
  C:\Windows\System\wSmysDr.exe
  2⤵
  PID:5744
- C:\Windows\System\BFemNpm.exe
  C:\Windows\System\BFemNpm.exe
  2⤵
  PID:5760
- C:\Windows\System\yTbqTJz.exe
  C:\Windows\System\yTbqTJz.exe
  2⤵
  PID:5776
- C:\Windows\System\OKwAOFx.exe
  C:\Windows\System\OKwAOFx.exe
  2⤵
  PID:5792
- C:\Windows\System\qIFVkXQ.exe
  C:\Windows\System\qIFVkXQ.exe
  2⤵
  PID:5812
- C:\Windows\System\LmuScFu.exe
  C:\Windows\System\LmuScFu.exe
  2⤵
  PID:5828
- C:\Windows\System\UAFtRaz.exe
  C:\Windows\System\UAFtRaz.exe
  2⤵
  PID:5844
- C:\Windows\System\cVhITFu.exe
  C:\Windows\System\cVhITFu.exe
  2⤵
  PID:5860
- C:\Windows\System\JJsFnJG.exe
  C:\Windows\System\JJsFnJG.exe
  2⤵
  PID:5880
- C:\Windows\System\NxUWBVY.exe
  C:\Windows\System\NxUWBVY.exe
  2⤵
  PID:5896
- C:\Windows\System\agpOgGQ.exe
  C:\Windows\System\agpOgGQ.exe
  2⤵
  PID:5912
- C:\Windows\System\pzKuobN.exe
  C:\Windows\System\pzKuobN.exe
  2⤵
  PID:5928
- C:\Windows\System\fcgSLXb.exe
  C:\Windows\System\fcgSLXb.exe
  2⤵
  PID:5944
- C:\Windows\System\XVDwaoA.exe
  C:\Windows\System\XVDwaoA.exe
  2⤵
  PID:5960
- C:\Windows\System\jxKEvBB.exe
  C:\Windows\System\jxKEvBB.exe
  2⤵
  PID:5976
- C:\Windows\System\vGTqybH.exe
  C:\Windows\System\vGTqybH.exe
  2⤵
  PID:5992
- C:\Windows\System\HDcXsJs.exe
  C:\Windows\System\HDcXsJs.exe
  2⤵
  PID:6008
- C:\Windows\System\VepHesY.exe
  C:\Windows\System\VepHesY.exe
  2⤵
  PID:6024
- C:\Windows\System\roCeMOB.exe
  C:\Windows\System\roCeMOB.exe
  2⤵
  PID:6040
- C:\Windows\System\gZoaHSm.exe
  C:\Windows\System\gZoaHSm.exe
  2⤵
  PID:6056
- C:\Windows\System\LqmbyAV.exe
  C:\Windows\System\LqmbyAV.exe
  2⤵
  PID:6072
- C:\Windows\System\GirNvmr.exe
  C:\Windows\System\GirNvmr.exe
  2⤵
  PID:5124
- C:\Windows\System\gmFQQYS.exe
  C:\Windows\System\gmFQQYS.exe
  2⤵
  PID:5160
- C:\Windows\System\BKyUTUb.exe
  C:\Windows\System\BKyUTUb.exe
  2⤵
  PID:4796
- C:\Windows\System\xDREFhO.exe
  C:\Windows\System\xDREFhO.exe
  2⤵
  PID:5264
- C:\Windows\System\biBfTEG.exe
  C:\Windows\System\biBfTEG.exe
  2⤵
  PID:5328
- C:\Windows\System\YRsOijt.exe
  C:\Windows\System\YRsOijt.exe
  2⤵
  PID:4508
- C:\Windows\System\rjDMSjQ.exe
  C:\Windows\System\rjDMSjQ.exe
  2⤵
  PID:4160
- C:\Windows\System\LKrZxyV.exe
  C:\Windows\System\LKrZxyV.exe
  2⤵
  PID:4224
- C:\Windows\System\BlvjSGM.exe
  C:\Windows\System\BlvjSGM.exe
  2⤵
  PID:5172
- C:\Windows\System\PejbVuM.exe
  C:\Windows\System\PejbVuM.exe
  2⤵
  PID:5244
- C:\Windows\System\vQIzlbZ.exe
  C:\Windows\System\vQIzlbZ.exe
  2⤵
  PID:5340
- C:\Windows\System\NrhaGhY.exe
  C:\Windows\System\NrhaGhY.exe
  2⤵
  PID:5356
- C:\Windows\System\FceZLtu.exe
  C:\Windows\System\FceZLtu.exe
  2⤵
  PID:5428
- C:\Windows\System\gWtceTt.exe
  C:\Windows\System\gWtceTt.exe
  2⤵
  PID:5488
- C:\Windows\System\ZbhLIUw.exe
  C:\Windows\System\ZbhLIUw.exe
  2⤵
  PID:5552
- C:\Windows\System\PhMITTQ.exe
  C:\Windows\System\PhMITTQ.exe
  2⤵
  PID:5692
- C:\Windows\System\rTvirPj.exe
  C:\Windows\System\rTvirPj.exe
  2⤵
  PID:5724
- C:\Windows\System\hsXGowM.exe
  C:\Windows\System\hsXGowM.exe
  2⤵
  PID:5820
- C:\Windows\System\jjIiBsu.exe
  C:\Windows\System\jjIiBsu.exe
  2⤵
  PID:5768
- C:\Windows\System\nxXarLh.exe
  C:\Windows\System\nxXarLh.exe
  2⤵
  PID:5540
- C:\Windows\System\MwMiLFb.exe
  C:\Windows\System\MwMiLFb.exe
  2⤵
  PID:5672
- C:\Windows\System\ogTmbVG.exe
  C:\Windows\System\ogTmbVG.exe
  2⤵
  PID:5772
- C:\Windows\System\ITRkujH.exe
  C:\Windows\System\ITRkujH.exe
  2⤵
  PID:5836
- C:\Windows\System\bCJQmvt.exe
  C:\Windows\System\bCJQmvt.exe
  2⤵
  PID:5852
- C:\Windows\System\DCOrpaH.exe
  C:\Windows\System\DCOrpaH.exe
  2⤵
  PID:5856
- C:\Windows\System\msYFOOK.exe
  C:\Windows\System\msYFOOK.exe
  2⤵
  PID:5920
- C:\Windows\System\qtiuSTA.exe
  C:\Windows\System\qtiuSTA.exe
  2⤵
  PID:5984
- C:\Windows\System\QNLAaGf.exe
  C:\Windows\System\QNLAaGf.exe
  2⤵
  PID:6048
- C:\Windows\System\UAStmVL.exe
  C:\Windows\System\UAStmVL.exe
  2⤵
  PID:5936
- C:\Windows\System\HREeUvE.exe
  C:\Windows\System\HREeUvE.exe
  2⤵
  PID:6032
- C:\Windows\System\lEsryJa.exe
  C:\Windows\System\lEsryJa.exe
  2⤵
  PID:6084
- C:\Windows\System\TDyUDiI.exe
  C:\Windows\System\TDyUDiI.exe
  2⤵
  PID:6100
- C:\Windows\System\ChJPNfu.exe
  C:\Windows\System\ChJPNfu.exe
  2⤵
  PID:6124
- C:\Windows\System\ezSsnGg.exe
  C:\Windows\System\ezSsnGg.exe
  2⤵
  PID:6128
- C:\Windows\System\XThbtwY.exe
  C:\Windows\System\XThbtwY.exe
  2⤵
  PID:5052
- C:\Windows\System\nnpXXwi.exe
  C:\Windows\System\nnpXXwi.exe
  2⤵
  PID:4900
- C:\Windows\System\vJCyWCL.exe
  C:\Windows\System\vJCyWCL.exe
  2⤵
  PID:5080
- C:\Windows\System\fjgocbq.exe
  C:\Windows\System\fjgocbq.exe
  2⤵
  PID:5296
- C:\Windows\System\dsPLfGo.exe
  C:\Windows\System\dsPLfGo.exe
  2⤵
  PID:5180
- C:\Windows\System\PWccHPM.exe
  C:\Windows\System\PWccHPM.exe
  2⤵
  PID:5156
- C:\Windows\System\mKUipzu.exe
  C:\Windows\System\mKUipzu.exe
  2⤵
  PID:5280
- C:\Windows\System\MVPqlpH.exe
  C:\Windows\System\MVPqlpH.exe
  2⤵
  PID:5312
- C:\Windows\System\GAWxkBL.exe
  C:\Windows\System\GAWxkBL.exe
  2⤵
  PID:5520
- C:\Windows\System\MVAvxUE.exe
  C:\Windows\System\MVAvxUE.exe
  2⤵
  PID:5248
- C:\Windows\System\cqaRrFl.exe
  C:\Windows\System\cqaRrFl.exe
  2⤵
  PID:5560
- C:\Windows\System\MmjLpBi.exe
  C:\Windows\System\MmjLpBi.exe
  2⤵
  PID:5588
- C:\Windows\System\LmYlkmb.exe
  C:\Windows\System\LmYlkmb.exe
  2⤵
  PID:5652
- C:\Windows\System\NIRCZye.exe
  C:\Windows\System\NIRCZye.exe
  2⤵
  PID:5636
- C:\Windows\System\EcLjhYo.exe
  C:\Windows\System\EcLjhYo.exe
  2⤵
  PID:5876
- C:\Windows\System\RfhYorR.exe
  C:\Windows\System\RfhYorR.exe
  2⤵
  PID:5756
- C:\Windows\System\tJpFxAe.exe
  C:\Windows\System\tJpFxAe.exe
  2⤵
  PID:5956
- C:\Windows\System\beTTqmi.exe
  C:\Windows\System\beTTqmi.exe
  2⤵
  PID:6108
- C:\Windows\System\CsHFQhm.exe
  C:\Windows\System\CsHFQhm.exe
  2⤵
  PID:5068
- C:\Windows\System\RoVIOqc.exe
  C:\Windows\System\RoVIOqc.exe
  2⤵
  PID:5140
- C:\Windows\System\NUNIFsr.exe
  C:\Windows\System\NUNIFsr.exe
  2⤵
  PID:5308
- C:\Windows\System\WwVnvlr.exe
  C:\Windows\System\WwVnvlr.exe
  2⤵
  PID:5788
- C:\Windows\System\FYFAwVM.exe
  C:\Windows\System\FYFAwVM.exe
  2⤵
  PID:6136
- C:\Windows\System\yUFnQEA.exe
  C:\Windows\System\yUFnQEA.exe
  2⤵
  PID:6148
- C:\Windows\System\VsRGMOK.exe
  C:\Windows\System\VsRGMOK.exe
  2⤵
  PID:6184
- C:\Windows\System\JPRyqXk.exe
  C:\Windows\System\JPRyqXk.exe
  2⤵
  PID:6200
- C:\Windows\System\IPiFOdX.exe
  C:\Windows\System\IPiFOdX.exe
  2⤵
  PID:6216
- C:\Windows\System\rsPCGMb.exe
  C:\Windows\System\rsPCGMb.exe
  2⤵
  PID:6232
- C:\Windows\System\nyBlaJY.exe
  C:\Windows\System\nyBlaJY.exe
  2⤵
  PID:6248
- C:\Windows\System\mTYidoH.exe
  C:\Windows\System\mTYidoH.exe
  2⤵
  PID:6268
- C:\Windows\System\gpgcwis.exe
  C:\Windows\System\gpgcwis.exe
  2⤵
  PID:6284
- C:\Windows\System\MxiUJqA.exe
  C:\Windows\System\MxiUJqA.exe
  2⤵
  PID:6300
- C:\Windows\System\ASgenwP.exe
  C:\Windows\System\ASgenwP.exe
  2⤵
  PID:6316
- C:\Windows\System\sAWSzaW.exe
  C:\Windows\System\sAWSzaW.exe
  2⤵
  PID:6332
- C:\Windows\System\FjrxmLW.exe
  C:\Windows\System\FjrxmLW.exe
  2⤵
  PID:6348
- C:\Windows\System\SHqXhKV.exe
  C:\Windows\System\SHqXhKV.exe
  2⤵
  PID:6364
- C:\Windows\System\YtRbKxA.exe
  C:\Windows\System\YtRbKxA.exe
  2⤵
  PID:6380
- C:\Windows\System\lxxzmrB.exe
  C:\Windows\System\lxxzmrB.exe
  2⤵
  PID:6396
- C:\Windows\System\OouRxaL.exe
  C:\Windows\System\OouRxaL.exe
  2⤵
  PID:6412
- C:\Windows\System\HSqRVzk.exe
  C:\Windows\System\HSqRVzk.exe
  2⤵
  PID:6428
- C:\Windows\System\OdWqfSe.exe
  C:\Windows\System\OdWqfSe.exe
  2⤵
  PID:6444
- C:\Windows\System\yBIfBFz.exe
  C:\Windows\System\yBIfBFz.exe
  2⤵
  PID:6460
- C:\Windows\System\inDykkb.exe
  C:\Windows\System\inDykkb.exe
  2⤵
  PID:6476
- C:\Windows\System\VZkNkQc.exe
  C:\Windows\System\VZkNkQc.exe
  2⤵
  PID:6492
- C:\Windows\System\sPpeGbm.exe
  C:\Windows\System\sPpeGbm.exe
  2⤵
  PID:6508
- C:\Windows\System\EomTiTh.exe
  C:\Windows\System\EomTiTh.exe
  2⤵
  PID:6524
- C:\Windows\System\RcSgedn.exe
  C:\Windows\System\RcSgedn.exe
  2⤵
  PID:6540
- C:\Windows\System\nykPRFp.exe
  C:\Windows\System\nykPRFp.exe
  2⤵
  PID:6556
- C:\Windows\System\bwhysNf.exe
  C:\Windows\System\bwhysNf.exe
  2⤵
  PID:6572
- C:\Windows\System\dHNSBal.exe
  C:\Windows\System\dHNSBal.exe
  2⤵
  PID:6588
- C:\Windows\System\sJrVPAr.exe
  C:\Windows\System\sJrVPAr.exe
  2⤵
  PID:6604
- C:\Windows\System\UOQgyFx.exe
  C:\Windows\System\UOQgyFx.exe
  2⤵
  PID:6620
- C:\Windows\System\RTZqQXf.exe
  C:\Windows\System\RTZqQXf.exe
  2⤵
  PID:6636
- C:\Windows\System\qSzJDzC.exe
  C:\Windows\System\qSzJDzC.exe
  2⤵
  PID:6652
- C:\Windows\System\pBQqeRb.exe
  C:\Windows\System\pBQqeRb.exe
  2⤵
  PID:6668
- C:\Windows\System\OIgUETe.exe
  C:\Windows\System\OIgUETe.exe
  2⤵
  PID:6684
- C:\Windows\System\FXmfniu.exe
  C:\Windows\System\FXmfniu.exe
  2⤵
  PID:6700
- C:\Windows\System\WzZHFzV.exe
  C:\Windows\System\WzZHFzV.exe
  2⤵
  PID:6716
- C:\Windows\System\FkeYRmp.exe
  C:\Windows\System\FkeYRmp.exe
  2⤵
  PID:6732
- C:\Windows\System\zpfxayy.exe
  C:\Windows\System\zpfxayy.exe
  2⤵
  PID:6748
- C:\Windows\System\fVkNppj.exe
  C:\Windows\System\fVkNppj.exe
  2⤵
  PID:6764
- C:\Windows\System\nurEoXa.exe
  C:\Windows\System\nurEoXa.exe
  2⤵
  PID:6780
- C:\Windows\System\xKYKcXt.exe
  C:\Windows\System\xKYKcXt.exe
  2⤵
  PID:6796
- C:\Windows\System\oVCDfQO.exe
  C:\Windows\System\oVCDfQO.exe
  2⤵
  PID:6812
- C:\Windows\System\rUOBVqw.exe
  C:\Windows\System\rUOBVqw.exe
  2⤵
  PID:6828
- C:\Windows\System\gYtMcOr.exe
  C:\Windows\System\gYtMcOr.exe
  2⤵
  PID:6844
- C:\Windows\System\kPEIxzo.exe
  C:\Windows\System\kPEIxzo.exe
  2⤵
  PID:6860
- C:\Windows\System\GTuuNdU.exe
  C:\Windows\System\GTuuNdU.exe
  2⤵
  PID:6876
- C:\Windows\System\vBzHtPG.exe
  C:\Windows\System\vBzHtPG.exe
  2⤵
  PID:6892
- C:\Windows\System\QyOCNWZ.exe
  C:\Windows\System\QyOCNWZ.exe
  2⤵
  PID:6908
- C:\Windows\System\RxifTfN.exe
  C:\Windows\System\RxifTfN.exe
  2⤵
  PID:6924
- C:\Windows\System\YWBguIw.exe
  C:\Windows\System\YWBguIw.exe
  2⤵
  PID:6940
- C:\Windows\System\TIqKGUT.exe
  C:\Windows\System\TIqKGUT.exe
  2⤵
  PID:6956
- C:\Windows\System\qFwlqzu.exe
  C:\Windows\System\qFwlqzu.exe
  2⤵
  PID:6972
- C:\Windows\System\DwOorIG.exe
  C:\Windows\System\DwOorIG.exe
  2⤵
  PID:6988
- C:\Windows\System\AxBTqwV.exe
  C:\Windows\System\AxBTqwV.exe
  2⤵
  PID:7004
- C:\Windows\System\VTzjViq.exe
  C:\Windows\System\VTzjViq.exe
  2⤵
  PID:7020
- C:\Windows\System\TeWjzGB.exe
  C:\Windows\System\TeWjzGB.exe
  2⤵
  PID:7036
- C:\Windows\System\PvPutif.exe
  C:\Windows\System\PvPutif.exe
  2⤵
  PID:7052
- C:\Windows\System\BUBekUl.exe
  C:\Windows\System\BUBekUl.exe
  2⤵
  PID:7068
- C:\Windows\System\NkSxRwY.exe
  C:\Windows\System\NkSxRwY.exe
  2⤵
  PID:7084
- C:\Windows\System\fRzuMaC.exe
  C:\Windows\System\fRzuMaC.exe
  2⤵
  PID:7100
- C:\Windows\System\eCxzIff.exe
  C:\Windows\System\eCxzIff.exe
  2⤵
  PID:7116
- C:\Windows\System\VlvDnBs.exe
  C:\Windows\System\VlvDnBs.exe
  2⤵
  PID:7132
- C:\Windows\System\nfyTUjZ.exe
  C:\Windows\System\nfyTUjZ.exe
  2⤵
  PID:7148
- C:\Windows\System\tOXIUmd.exe
  C:\Windows\System\tOXIUmd.exe
  2⤵
  PID:7164
- C:\Windows\System\ByaBRJA.exe
  C:\Windows\System\ByaBRJA.exe
  2⤵
  PID:6156
- C:\Windows\System\dVsKufZ.exe
  C:\Windows\System\dVsKufZ.exe
  2⤵
  PID:5472
- C:\Windows\System\tdENsiv.exe
  C:\Windows\System\tdENsiv.exe
  2⤵
  PID:5660
- C:\Windows\System\sLcZSeH.exe
  C:\Windows\System\sLcZSeH.exe
  2⤵
  PID:5624
- C:\Windows\System\KTIZMCN.exe
  C:\Windows\System\KTIZMCN.exe
  2⤵
  PID:5752
- C:\Windows\System\hoVEQMB.exe
  C:\Windows\System\hoVEQMB.exe
  2⤵
  PID:5800
- C:\Windows\System\zwEWPWB.exe
  C:\Windows\System\zwEWPWB.exe
  2⤵
  PID:5892
- C:\Windows\System\UOeQdlw.exe
  C:\Windows\System\UOeQdlw.exe
  2⤵
  PID:6092
- C:\Windows\System\UggQsJd.exe
  C:\Windows\System\UggQsJd.exe
  2⤵
  PID:5064
- C:\Windows\System\orohowx.exe
  C:\Windows\System\orohowx.exe
  2⤵
  PID:4964
- C:\Windows\System\DIxLwDY.exe
  C:\Windows\System\DIxLwDY.exe
  2⤵
  PID:4396
- C:\Windows\System\wqFxTtT.exe
  C:\Windows\System\wqFxTtT.exe
  2⤵
  PID:5676
- C:\Windows\System\OfMOBOB.exe
  C:\Windows\System\OfMOBOB.exe
  2⤵
  PID:5048
- C:\Windows\System\aGhCcXp.exe
  C:\Windows\System\aGhCcXp.exe
  2⤵
  PID:5424
- C:\Windows\System\nXCvKto.exe
  C:\Windows\System\nXCvKto.exe
  2⤵
  PID:6212
- C:\Windows\System\mKINkNj.exe
  C:\Windows\System\mKINkNj.exe
  2⤵
  PID:6276
- C:\Windows\System\EEnJSzj.exe
  C:\Windows\System\EEnJSzj.exe
  2⤵
  PID:6344
- C:\Windows\System\nJIHWkf.exe
  C:\Windows\System\nJIHWkf.exe
  2⤵
  PID:6224
- C:\Windows\System\hMlxXVi.exe
  C:\Windows\System\hMlxXVi.exe
  2⤵
  PID:6264
- C:\Windows\System\hzgObMb.exe
  C:\Windows\System\hzgObMb.exe
  2⤵
  PID:6328
- C:\Windows\System\uRRneND.exe
  C:\Windows\System\uRRneND.exe
  2⤵
  PID:6376
- C:\Windows\System\DldvQZP.exe
  C:\Windows\System\DldvQZP.exe
  2⤵
  PID:6436
- C:\Windows\System\pEDoDHJ.exe
  C:\Windows\System\pEDoDHJ.exe
  2⤵
  PID:6504
- C:\Windows\System\ESwqCnw.exe
  C:\Windows\System\ESwqCnw.exe
  2⤵
  PID:6532
- C:\Windows\System\kxDozTo.exe
  C:\Windows\System\kxDozTo.exe
  2⤵
  PID:6600
- C:\Windows\System\dmazQrN.exe
  C:\Windows\System\dmazQrN.exe
  2⤵
  PID:6632
- C:\Windows\System\OEKCYLq.exe
  C:\Windows\System\OEKCYLq.exe
  2⤵
  PID:6484
- C:\Windows\System\vKhAznd.exe
  C:\Windows\System\vKhAznd.exe
  2⤵
  PID:6584
- C:\Windows\System\AoKsgnB.exe
  C:\Windows\System\AoKsgnB.exe
  2⤵
  PID:6648
- C:\Windows\System\hxzxlSn.exe
  C:\Windows\System\hxzxlSn.exe
  2⤵
  PID:6696
- C:\Windows\System\LMXmxOP.exe
  C:\Windows\System\LMXmxOP.exe
  2⤵
  PID:5872
- C:\Windows\System\AiFJpjV.exe
  C:\Windows\System\AiFJpjV.exe
  2⤵
  PID:6760
- C:\Windows\System\bcDyTSX.exe
  C:\Windows\System\bcDyTSX.exe
  2⤵
  PID:6772
- C:\Windows\System\gbTfaxc.exe
  C:\Windows\System\gbTfaxc.exe
  2⤵
  PID:6836
- C:\Windows\System\onfDqmK.exe
  C:\Windows\System\onfDqmK.exe
  2⤵
  PID:6852
- C:\Windows\System\uOewviy.exe
  C:\Windows\System\uOewviy.exe
  2⤵
  PID:6916
- C:\Windows\System\MLyqePu.exe
  C:\Windows\System\MLyqePu.exe
  2⤵
  PID:6868
- C:\Windows\System\XpdajkE.exe
  C:\Windows\System\XpdajkE.exe
  2⤵
  PID:6904
- C:\Windows\System\lznVuTl.exe
  C:\Windows\System\lznVuTl.exe
  2⤵
  PID:6980
- C:\Windows\System\vxbdjcB.exe
  C:\Windows\System\vxbdjcB.exe
  2⤵
  PID:7016
- C:\Windows\System\xzEHRxT.exe
  C:\Windows\System\xzEHRxT.exe
  2⤵
  PID:6996
- C:\Windows\System\ZmxxorK.exe
  C:\Windows\System\ZmxxorK.exe
  2⤵
  PID:7064
- C:\Windows\System\dDUmnoD.exe
  C:\Windows\System\dDUmnoD.exe
  2⤵
  PID:7112
- C:\Windows\System\nNXqkng.exe
  C:\Windows\System\nNXqkng.exe
  2⤵
  PID:7096
- C:\Windows\System\FEhhVME.exe
  C:\Windows\System\FEhhVME.exe
  2⤵
  PID:5576
- C:\Windows\System\qsrSeRC.exe
  C:\Windows\System\qsrSeRC.exe
  2⤵
  PID:5444
- C:\Windows\System\SmcEyrk.exe
  C:\Windows\System\SmcEyrk.exe
  2⤵
  PID:7156
- C:\Windows\System\JBBwoqP.exe
  C:\Windows\System\JBBwoqP.exe
  2⤵
  PID:5508
- C:\Windows\System\uVmmgid.exe
  C:\Windows\System\uVmmgid.exe
  2⤵
  PID:5972
- C:\Windows\System\nTQOYkY.exe
  C:\Windows\System\nTQOYkY.exe
  2⤵
  PID:5456
- C:\Windows\System\LjDfADa.exe
  C:\Windows\System\LjDfADa.exe
  2⤵
  PID:5020
- C:\Windows\System\heuNGZz.exe
  C:\Windows\System\heuNGZz.exe
  2⤵
  PID:6180
- C:\Windows\System\lGKbjRl.exe
  C:\Windows\System\lGKbjRl.exe
  2⤵
  PID:6308
- C:\Windows\System\oRxwWWI.exe
  C:\Windows\System\oRxwWWI.exe
  2⤵
  PID:6240
- C:\Windows\System\skoXagY.exe
  C:\Windows\System\skoXagY.exe
  2⤵
  PID:6324
- C:\Windows\System\dPuTSyf.exe
  C:\Windows\System\dPuTSyf.exe
  2⤵
  PID:6388
- C:\Windows\System\uGlOsLO.exe
  C:\Windows\System\uGlOsLO.exe
  2⤵
  PID:6536
- C:\Windows\System\AAUYhBX.exe
  C:\Windows\System\AAUYhBX.exe
  2⤵
  PID:6568
- C:\Windows\System\AxDFSwM.exe
  C:\Windows\System\AxDFSwM.exe
  2⤵
  PID:6552
- C:\Windows\System\QvCjtdO.exe
  C:\Windows\System\QvCjtdO.exe
  2⤵
  PID:6692
- C:\Windows\System\dWUeykS.exe
  C:\Windows\System\dWUeykS.exe
  2⤵
  PID:6788
- C:\Windows\System\nmHovWg.exe
  C:\Windows\System\nmHovWg.exe
  2⤵
  PID:6708
- C:\Windows\System\lmxLfhT.exe
  C:\Windows\System\lmxLfhT.exe
  2⤵
  PID:6888
- C:\Windows\System\yKBFfdO.exe
  C:\Windows\System\yKBFfdO.exe
  2⤵
  PID:6948
- C:\Windows\System\ymoEowp.exe
  C:\Windows\System\ymoEowp.exe
  2⤵
  PID:6964
- C:\Windows\System\HdUdtzU.exe
  C:\Windows\System\HdUdtzU.exe
  2⤵
  PID:7060
- C:\Windows\System\NobXxLO.exe
  C:\Windows\System\NobXxLO.exe
  2⤵
  PID:7000
- C:\Windows\System\wniyGxH.exe
  C:\Windows\System\wniyGxH.exe
  2⤵
  PID:5736
- C:\Windows\System\ABKCvno.exe
  C:\Windows\System\ABKCvno.exe
  2⤵
  PID:6096
- C:\Windows\System\gdGElbX.exe
  C:\Windows\System\gdGElbX.exe
  2⤵
  PID:1712
- C:\Windows\System\NHFBcOi.exe
  C:\Windows\System\NHFBcOi.exe
  2⤵
  PID:5940
- C:\Windows\System\JAFyyvK.exe
  C:\Windows\System\JAFyyvK.exe
  2⤵
  PID:6120
- C:\Windows\System\lLBVLGR.exe
  C:\Windows\System\lLBVLGR.exe
  2⤵
  PID:6360
- C:\Windows\System\bQidvDk.exe
  C:\Windows\System\bQidvDk.exe
  2⤵
  PID:6260
- C:\Windows\System\hBbEGbE.exe
  C:\Windows\System\hBbEGbE.exe
  2⤵
  PID:6712
- C:\Windows\System\pgLGDXQ.exe
  C:\Windows\System\pgLGDXQ.exe
  2⤵
  PID:6884
- C:\Windows\System\WhakCOl.exe
  C:\Windows\System\WhakCOl.exe
  2⤵
  PID:6172
- C:\Windows\System\vdryunV.exe
  C:\Windows\System\vdryunV.exe
  2⤵
  PID:6664
- C:\Windows\System\urRRcQV.exe
  C:\Windows\System\urRRcQV.exe
  2⤵
  PID:6984
- C:\Windows\System\WiSGEbT.exe
  C:\Windows\System\WiSGEbT.exe
  2⤵
  PID:4228
- C:\Windows\System\jxSCjIK.exe
  C:\Windows\System\jxSCjIK.exe
  2⤵
  PID:6068
- C:\Windows\System\VTblBfk.exe
  C:\Windows\System\VTblBfk.exe
  2⤵
  PID:6500
- C:\Windows\System\WyUsYIM.exe
  C:\Windows\System\WyUsYIM.exe
  2⤵
  PID:6424
- C:\Windows\System\gmTfhlb.exe
  C:\Windows\System\gmTfhlb.exe
  2⤵
  PID:7028
- C:\Windows\System\aeDjOBe.exe
  C:\Windows\System\aeDjOBe.exe
  2⤵
  PID:5784
- C:\Windows\System\ORErETa.exe
  C:\Windows\System\ORErETa.exe
  2⤵
  PID:5608
- C:\Windows\System\bmSvGTf.exe
  C:\Windows\System\bmSvGTf.exe
  2⤵
  PID:6644
- C:\Windows\System\zuDLgkM.exe
  C:\Windows\System\zuDLgkM.exe
  2⤵
  PID:6824
- C:\Windows\System\kfehgrh.exe
  C:\Windows\System\kfehgrh.exe
  2⤵
  PID:7180
- C:\Windows\System\eJkTQNG.exe
  C:\Windows\System\eJkTQNG.exe
  2⤵
  PID:7196
- C:\Windows\System\ZqTyeCD.exe
  C:\Windows\System\ZqTyeCD.exe
  2⤵
  PID:7212
- C:\Windows\System\KNvAvfF.exe
  C:\Windows\System\KNvAvfF.exe
  2⤵
  PID:7228
- C:\Windows\System\HCsCOHx.exe
  C:\Windows\System\HCsCOHx.exe
  2⤵
  PID:7244
- C:\Windows\System\zYUGOXJ.exe
  C:\Windows\System\zYUGOXJ.exe
  2⤵
  PID:7260
- C:\Windows\System\OZYrWzf.exe
  C:\Windows\System\OZYrWzf.exe
  2⤵
  PID:7276
- C:\Windows\System\FnyiLQb.exe
  C:\Windows\System\FnyiLQb.exe
  2⤵
  PID:7292
- C:\Windows\System\DHFMWyY.exe
  C:\Windows\System\DHFMWyY.exe
  2⤵
  PID:7308
- C:\Windows\System\dEfJqft.exe
  C:\Windows\System\dEfJqft.exe
  2⤵
  PID:7324
- C:\Windows\System\lJrYBXV.exe
  C:\Windows\System\lJrYBXV.exe
  2⤵
  PID:7340
- C:\Windows\System\zdsqIME.exe
  C:\Windows\System\zdsqIME.exe
  2⤵
  PID:7356
- C:\Windows\System\PwqhzZs.exe
  C:\Windows\System\PwqhzZs.exe
  2⤵
  PID:7372
- C:\Windows\System\QflVoBq.exe
  C:\Windows\System\QflVoBq.exe
  2⤵
  PID:7388
- C:\Windows\System\lKLqnMG.exe
  C:\Windows\System\lKLqnMG.exe
  2⤵
  PID:7404
- C:\Windows\System\aKgNrmi.exe
  C:\Windows\System\aKgNrmi.exe
  2⤵
  PID:7420
- C:\Windows\System\vhrCada.exe
  C:\Windows\System\vhrCada.exe
  2⤵
  PID:7436
- C:\Windows\System\KOZruiU.exe
  C:\Windows\System\KOZruiU.exe
  2⤵
  PID:7452
- C:\Windows\System\KVGemST.exe
  C:\Windows\System\KVGemST.exe
  2⤵
  PID:7468
- C:\Windows\System\aEEWMeB.exe
  C:\Windows\System\aEEWMeB.exe
  2⤵
  PID:7488
- C:\Windows\System\lkHWXPZ.exe
  C:\Windows\System\lkHWXPZ.exe
  2⤵
  PID:7540
- C:\Windows\System\Aemvlol.exe
  C:\Windows\System\Aemvlol.exe
  2⤵
  PID:7556
- C:\Windows\System\fLgbGRi.exe
  C:\Windows\System\fLgbGRi.exe
  2⤵
  PID:7572
- C:\Windows\System\xjshYvM.exe
  C:\Windows\System\xjshYvM.exe
  2⤵
  PID:7588
- C:\Windows\System\UGgekEo.exe
  C:\Windows\System\UGgekEo.exe
  2⤵
  PID:7604
- C:\Windows\System\xiqkqYK.exe
  C:\Windows\System\xiqkqYK.exe
  2⤵
  PID:7620
- C:\Windows\System\WsEjcjv.exe
  C:\Windows\System\WsEjcjv.exe
  2⤵
  PID:7636
- C:\Windows\System\ZbyHhmd.exe
  C:\Windows\System\ZbyHhmd.exe
  2⤵
  PID:7652
- C:\Windows\System\tGqNtSa.exe
  C:\Windows\System\tGqNtSa.exe
  2⤵
  PID:7668
- C:\Windows\System\GlzrRCD.exe
  C:\Windows\System\GlzrRCD.exe
  2⤵
  PID:7684
- C:\Windows\System\oCPRVUL.exe
  C:\Windows\System\oCPRVUL.exe
  2⤵
  PID:7700
- C:\Windows\System\KzTveDb.exe
  C:\Windows\System\KzTveDb.exe
  2⤵
  PID:7716
- C:\Windows\System\vuyYHad.exe
  C:\Windows\System\vuyYHad.exe
  2⤵
  PID:7732
- C:\Windows\System\erYyIUk.exe
  C:\Windows\System\erYyIUk.exe
  2⤵
  PID:7748
- C:\Windows\System\mVExANy.exe
  C:\Windows\System\mVExANy.exe
  2⤵
  PID:7764
- C:\Windows\System\azTOtqS.exe
  C:\Windows\System\azTOtqS.exe
  2⤵
  PID:7780
- C:\Windows\System\kWPMZnU.exe
  C:\Windows\System\kWPMZnU.exe
  2⤵
  PID:7796
- C:\Windows\System\dcxryZl.exe
  C:\Windows\System\dcxryZl.exe
  2⤵
  PID:7812
- C:\Windows\System\NuXBZay.exe
  C:\Windows\System\NuXBZay.exe
  2⤵
  PID:7828
- C:\Windows\System\rhmpqYA.exe
  C:\Windows\System\rhmpqYA.exe
  2⤵
  PID:7844
- C:\Windows\System\BthtktJ.exe
  C:\Windows\System\BthtktJ.exe
  2⤵
  PID:7860
- C:\Windows\System\UIYYBsi.exe
  C:\Windows\System\UIYYBsi.exe
  2⤵
  PID:7876
- C:\Windows\System\YyppOEv.exe
  C:\Windows\System\YyppOEv.exe
  2⤵
  PID:7892
- C:\Windows\System\dZZFZKf.exe
  C:\Windows\System\dZZFZKf.exe
  2⤵
  PID:7908
- C:\Windows\System\caYGfaO.exe
  C:\Windows\System\caYGfaO.exe
  2⤵
  PID:7924
- C:\Windows\System\UTFhwBB.exe
  C:\Windows\System\UTFhwBB.exe
  2⤵
  PID:7940
- C:\Windows\System\XCtxQsE.exe
  C:\Windows\System\XCtxQsE.exe
  2⤵
  PID:7956
- C:\Windows\System\psgoxRC.exe
  C:\Windows\System\psgoxRC.exe
  2⤵
  PID:7972
- C:\Windows\System\HgNdSGW.exe
  C:\Windows\System\HgNdSGW.exe
  2⤵
  PID:7992
- C:\Windows\System\NLcMIzl.exe
  C:\Windows\System\NLcMIzl.exe
  2⤵
  PID:8008
- C:\Windows\System\CMdwRUi.exe
  C:\Windows\System\CMdwRUi.exe
  2⤵
  PID:8024
- C:\Windows\System\zqGFmQt.exe
  C:\Windows\System\zqGFmQt.exe
  2⤵
  PID:8040
- C:\Windows\System\FuQpMjs.exe
  C:\Windows\System\FuQpMjs.exe
  2⤵
  PID:8056
- C:\Windows\System\hxHEHxF.exe
  C:\Windows\System\hxHEHxF.exe
  2⤵
  PID:8072
- C:\Windows\System\LvOZShl.exe
  C:\Windows\System\LvOZShl.exe
  2⤵
  PID:8088
- C:\Windows\System\qRNbpmB.exe
  C:\Windows\System\qRNbpmB.exe
  2⤵
  PID:8104
- C:\Windows\System\MqzpnHW.exe
  C:\Windows\System\MqzpnHW.exe
  2⤵
  PID:8120
- C:\Windows\System\TPiqIVr.exe
  C:\Windows\System\TPiqIVr.exe
  2⤵
  PID:7192
- C:\Windows\System\XfuaacD.exe
  C:\Windows\System\XfuaacD.exe
  2⤵
  PID:7316
- C:\Windows\System\FRkNltz.exe
  C:\Windows\System\FRkNltz.exe
  2⤵
  PID:7348
- C:\Windows\System\ACSXOni.exe
  C:\Windows\System\ACSXOni.exe
  2⤵
  PID:7412
- C:\Windows\System\rNCVWdJ.exe
  C:\Windows\System\rNCVWdJ.exe
  2⤵
  PID:7628
- C:\Windows\System\pQcnFhi.exe
  C:\Windows\System\pQcnFhi.exe
  2⤵
  PID:7696
- C:\Windows\System\tVyxXNg.exe
  C:\Windows\System\tVyxXNg.exe
  2⤵
  PID:7792
- C:\Windows\System\mJPUIFq.exe
  C:\Windows\System\mJPUIFq.exe
  2⤵
  PID:7868
- C:\Windows\System\eLaKNnd.exe
  C:\Windows\System\eLaKNnd.exe
  2⤵
  PID:7888
- C:\Windows\System\bcEFgpO.exe
  C:\Windows\System\bcEFgpO.exe
  2⤵
  PID:7952
- C:\Windows\System\ndLRrpF.exe
  C:\Windows\System\ndLRrpF.exe
  2⤵
  PID:7900
- C:\Windows\System\lOXPJET.exe
  C:\Windows\System\lOXPJET.exe
  2⤵
  PID:8016
- C:\Windows\System\mkrqnGP.exe
  C:\Windows\System\mkrqnGP.exe
  2⤵
  PID:7936
- C:\Windows\System\qrmqBjM.exe
  C:\Windows\System\qrmqBjM.exe
  2⤵
  PID:8080
- C:\Windows\System\FkAdIZa.exe
  C:\Windows\System\FkAdIZa.exe
  2⤵
  PID:8112
- C:\Windows\System\MwpXBxF.exe
  C:\Windows\System\MwpXBxF.exe
  2⤵
  PID:8068
- C:\Windows\System\uorILaH.exe
  C:\Windows\System\uorILaH.exe
  2⤵
  PID:8136
- C:\Windows\System\RWYwxlB.exe
  C:\Windows\System\RWYwxlB.exe
  2⤵
  PID:8152
- C:\Windows\System\NUFNkIa.exe
  C:\Windows\System\NUFNkIa.exe
  2⤵
  PID:8168
- C:\Windows\System\GVKjqgV.exe
  C:\Windows\System\GVKjqgV.exe
  2⤵
  PID:7204
- C:\Windows\System\DFqVrAU.exe
  C:\Windows\System\DFqVrAU.exe
  2⤵
  PID:7236
- C:\Windows\System\CdydSUo.exe
  C:\Windows\System\CdydSUo.exe
  2⤵
  PID:6064
- C:\Windows\System\UVMkQZq.exe
  C:\Windows\System\UVMkQZq.exe
  2⤵
  PID:7272
- C:\Windows\System\WAkiGsZ.exe
  C:\Windows\System\WAkiGsZ.exe
  2⤵
  PID:5968
- C:\Windows\System\xxFIJec.exe
  C:\Windows\System\xxFIJec.exe
  2⤵
  PID:7364
- C:\Windows\System\PKQStmG.exe
  C:\Windows\System\PKQStmG.exe
  2⤵
  PID:7320
- C:\Windows\System\XDWwCVu.exe
  C:\Windows\System\XDWwCVu.exe
  2⤵
  PID:7384
- C:\Windows\System\jmJXJel.exe
  C:\Windows\System\jmJXJel.exe
  2⤵
  PID:6520
- C:\Windows\System\iArasGX.exe
  C:\Windows\System\iArasGX.exe
  2⤵
  PID:7500
- C:\Windows\System\UVWjpFF.exe
  C:\Windows\System\UVWjpFF.exe
  2⤵
  PID:7520
- C:\Windows\System\czDBeNw.exe
  C:\Windows\System\czDBeNw.exe
  2⤵
  PID:7532
- C:\Windows\System\zcYfIAA.exe
  C:\Windows\System\zcYfIAA.exe
  2⤵
  PID:7580
- C:\Windows\System\LzhRPai.exe
  C:\Windows\System\LzhRPai.exe
  2⤵
  PID:7644
- C:\Windows\System\gEALgwy.exe
  C:\Windows\System\gEALgwy.exe
  2⤵
  PID:7708
- C:\Windows\System\DtMyDxn.exe
  C:\Windows\System\DtMyDxn.exe
  2⤵
  PID:7772
- C:\Windows\System\NRObkIN.exe
  C:\Windows\System\NRObkIN.exe
  2⤵
  PID:7804
- C:\Windows\System\pOPfHBq.exe
  C:\Windows\System\pOPfHBq.exe
  2⤵
  PID:7692
- C:\Windows\System\aAYArYp.exe
  C:\Windows\System\aAYArYp.exe
  2⤵
  PID:7820
- C:\Windows\System\ZpDGzVN.exe
  C:\Windows\System\ZpDGzVN.exe
  2⤵
  PID:7600
- C:\Windows\System\NnQAgkw.exe
  C:\Windows\System\NnQAgkw.exe
  2⤵
  PID:7884
- C:\Windows\System\MIAzbHS.exe
  C:\Windows\System\MIAzbHS.exe
  2⤵
  PID:8048
- C:\Windows\System\vfNUvaP.exe
  C:\Windows\System\vfNUvaP.exe
  2⤵
  PID:8084
- C:\Windows\System\pbGqoyO.exe
  C:\Windows\System\pbGqoyO.exe
  2⤵
  PID:8132
- C:\Windows\System\JceJoOz.exe
  C:\Windows\System\JceJoOz.exe
  2⤵
  PID:8100
- C:\Windows\System\hGOblod.exe
  C:\Windows\System\hGOblod.exe
  2⤵
  PID:7948
- C:\Windows\System\VCGZuWs.exe
  C:\Windows\System\VCGZuWs.exe
  2⤵
  PID:7268
- C:\Windows\System\LHosbTJ.exe
  C:\Windows\System\LHosbTJ.exe
  2⤵
  PID:7284
- C:\Windows\System\IqQvaRq.exe
  C:\Windows\System\IqQvaRq.exe
  2⤵
  PID:7240
- C:\Windows\System\YdDuLNF.exe
  C:\Windows\System\YdDuLNF.exe
  2⤵
  PID:7400
- C:\Windows\System\KzoThiW.exe
  C:\Windows\System\KzoThiW.exe
  2⤵
  PID:7512
- C:\Windows\System\kvLevWP.exe
  C:\Windows\System\kvLevWP.exe
  2⤵
  PID:7524
- C:\Windows\System\AhHCoQa.exe
  C:\Windows\System\AhHCoQa.exe
  2⤵
  PID:7564
- C:\Windows\System\xBaYbRX.exe
  C:\Windows\System\xBaYbRX.exe
  2⤵
  PID:7676
- C:\Windows\System\zxyzURG.exe
  C:\Windows\System\zxyzURG.exe
  2⤵
  PID:7568
- C:\Windows\System\FXixYcp.exe
  C:\Windows\System\FXixYcp.exe
  2⤵
  PID:8036
- C:\Windows\System\SZjuXgn.exe
  C:\Windows\System\SZjuXgn.exe
  2⤵
  PID:7744
- C:\Windows\System\KAeTqfI.exe
  C:\Windows\System\KAeTqfI.exe
  2⤵
  PID:8020
- C:\Windows\System\SCbUeSF.exe
  C:\Windows\System\SCbUeSF.exe
  2⤵
  PID:7664
- C:\Windows\System\qRUmAoH.exe
  C:\Windows\System\qRUmAoH.exe
  2⤵
  PID:6616
- C:\Windows\System\rJWNvUF.exe
  C:\Windows\System\rJWNvUF.exe
  2⤵
  PID:7220
- C:\Windows\System\QmZsPKa.exe
  C:\Windows\System\QmZsPKa.exe
  2⤵
  PID:7508
- C:\Windows\System\FnpqfNl.exe
  C:\Windows\System\FnpqfNl.exe
  2⤵
  PID:6744
- C:\Windows\System\dzIwnOh.exe
  C:\Windows\System\dzIwnOh.exe
  2⤵
  PID:7188
- C:\Windows\System\RoCBKwy.exe
  C:\Windows\System\RoCBKwy.exe
  2⤵
  PID:7528
- C:\Windows\System\kywDdlU.exe
  C:\Windows\System\kywDdlU.exe
  2⤵
  PID:7616
- C:\Windows\System\fCVwWVR.exe
  C:\Windows\System\fCVwWVR.exe
  2⤵
  PID:7300
- C:\Windows\System\HlYNpjL.exe
  C:\Windows\System\HlYNpjL.exe
  2⤵
  PID:8196
- C:\Windows\System\xokzjBM.exe
  C:\Windows\System\xokzjBM.exe
  2⤵
  PID:8212
- C:\Windows\System\QfhYoNZ.exe
  C:\Windows\System\QfhYoNZ.exe
  2⤵
  PID:8236
- C:\Windows\System\NTgRfVh.exe
  C:\Windows\System\NTgRfVh.exe
  2⤵
  PID:8260
- C:\Windows\System\OTUieDp.exe
  C:\Windows\System\OTUieDp.exe
  2⤵
  PID:8276
- C:\Windows\System\EoXIryv.exe
  C:\Windows\System\EoXIryv.exe
  2⤵
  PID:8292
- C:\Windows\System\tccZTLv.exe
  C:\Windows\System\tccZTLv.exe
  2⤵
  PID:8308
- C:\Windows\System\cvZcMQQ.exe
  C:\Windows\System\cvZcMQQ.exe
  2⤵
  PID:8324
- C:\Windows\System\ZtxgKmZ.exe
  C:\Windows\System\ZtxgKmZ.exe
  2⤵
  PID:8340
- C:\Windows\System\KVSZOFH.exe
  C:\Windows\System\KVSZOFH.exe
  2⤵
  PID:8356
- C:\Windows\System\yhxHfPi.exe
  C:\Windows\System\yhxHfPi.exe
  2⤵
  PID:8372
- C:\Windows\System\TizXICI.exe
  C:\Windows\System\TizXICI.exe
  2⤵
  PID:8388
- C:\Windows\System\lLSBdHQ.exe
  C:\Windows\System\lLSBdHQ.exe
  2⤵
  PID:8404
- C:\Windows\System\itagqmB.exe
  C:\Windows\System\itagqmB.exe
  2⤵
  PID:8420
- C:\Windows\System\NXKiVWE.exe
  C:\Windows\System\NXKiVWE.exe
  2⤵
  PID:8436
- C:\Windows\System\RmtInvz.exe
  C:\Windows\System\RmtInvz.exe
  2⤵
  PID:8452
- C:\Windows\System\ssbjAQk.exe
  C:\Windows\System\ssbjAQk.exe
  2⤵
  PID:8472
- C:\Windows\System\rnqMWzo.exe
  C:\Windows\System\rnqMWzo.exe
  2⤵
  PID:8492
- C:\Windows\System\bLOiCGq.exe
  C:\Windows\System\bLOiCGq.exe
  2⤵
  PID:8528
- C:\Windows\System\FZGmFqi.exe
  C:\Windows\System\FZGmFqi.exe
  2⤵
  PID:8544
- C:\Windows\System\NkJzKIE.exe
  C:\Windows\System\NkJzKIE.exe
  2⤵
  PID:8568
- C:\Windows\System\BPGkdmU.exe
  C:\Windows\System\BPGkdmU.exe
  2⤵
  PID:8592
- C:\Windows\System\IuhFlOG.exe
  C:\Windows\System\IuhFlOG.exe
  2⤵
  PID:8608
- C:\Windows\System\PpLiyxv.exe
  C:\Windows\System\PpLiyxv.exe
  2⤵
  PID:8624
- C:\Windows\System\hufHIJv.exe
  C:\Windows\System\hufHIJv.exe
  2⤵
  PID:8640
- C:\Windows\System\pHbXNJj.exe
  C:\Windows\System\pHbXNJj.exe
  2⤵
  PID:8660
- C:\Windows\System\CPBPpyq.exe
  C:\Windows\System\CPBPpyq.exe
  2⤵
  PID:8684
- C:\Windows\System\bUuVAZn.exe
  C:\Windows\System\bUuVAZn.exe
  2⤵
  PID:8704
- C:\Windows\System\fiOCsTN.exe
  C:\Windows\System\fiOCsTN.exe
  2⤵
  PID:8720
- C:\Windows\System\vqqPyrE.exe
  C:\Windows\System\vqqPyrE.exe
  2⤵
  PID:8740
- C:\Windows\System\rrMFszM.exe
  C:\Windows\System\rrMFszM.exe
  2⤵
  PID:8756
- C:\Windows\System\SKdPaFX.exe
  C:\Windows\System\SKdPaFX.exe
  2⤵
  PID:8780
- C:\Windows\System\xvgzcvt.exe
  C:\Windows\System\xvgzcvt.exe
  2⤵
  PID:8800
- C:\Windows\System\cWroQeb.exe
  C:\Windows\System\cWroQeb.exe
  2⤵
  PID:8924
- C:\Windows\System\hsaBZWJ.exe
  C:\Windows\System\hsaBZWJ.exe
  2⤵
  PID:8352
- C:\Windows\System\InTZJNk.exe
  C:\Windows\System\InTZJNk.exe
  2⤵
  PID:8560
- C:\Windows\System\sSQVNAC.exe
  C:\Windows\System\sSQVNAC.exe
  2⤵
  PID:8636
- C:\Windows\System\oJgFNoH.exe
  C:\Windows\System\oJgFNoH.exe
  2⤵
  PID:8680
- C:\Windows\System\sTRoEmL.exe
  C:\Windows\System\sTRoEmL.exe
  2⤵
  PID:8788
- C:\Windows\System\EkSirEB.exe
  C:\Windows\System\EkSirEB.exe
  2⤵
  PID:8944
- C:\Windows\System\lwsLvse.exe
  C:\Windows\System\lwsLvse.exe
  2⤵
  PID:8960
- C:\Windows\System\eoVuZaE.exe
  C:\Windows\System\eoVuZaE.exe
  2⤵
  PID:8976
- C:\Windows\System\GBkNGVa.exe
  C:\Windows\System\GBkNGVa.exe
  2⤵
  PID:8992
- C:\Windows\System\TPkfujX.exe
  C:\Windows\System\TPkfujX.exe
  2⤵
  PID:9012
- C:\Windows\System\uMmHJUT.exe
  C:\Windows\System\uMmHJUT.exe
  2⤵
  PID:9036
- C:\Windows\System\onBavXr.exe
  C:\Windows\System\onBavXr.exe
  2⤵
  PID:9060
- C:\Windows\System\HFPjVjX.exe
  C:\Windows\System\HFPjVjX.exe
  2⤵
  PID:9080
- C:\Windows\System\HibFNwM.exe
  C:\Windows\System\HibFNwM.exe
  2⤵
  PID:9104
- C:\Windows\System\AprsYVj.exe
  C:\Windows\System\AprsYVj.exe
  2⤵
  PID:9132
- C:\Windows\System\LvlpXwc.exe
  C:\Windows\System\LvlpXwc.exe
  2⤵
  PID:9160
- C:\Windows\System\jUpceMm.exe
  C:\Windows\System\jUpceMm.exe
  2⤵
  PID:9192
- C:\Windows\System\cKGOmUL.exe
  C:\Windows\System\cKGOmUL.exe
  2⤵
  PID:8208
- C:\Windows\System\gQlOVIS.exe
  C:\Windows\System\gQlOVIS.exe
  2⤵
  PID:7660
- C:\Windows\System\nmTJbKc.exe
  C:\Windows\System\nmTJbKc.exe
  2⤵
  PID:8936
- C:\Windows\System\nFQugUd.exe
  C:\Windows\System\nFQugUd.exe
  2⤵
  PID:8232
- C:\Windows\System\pXGMPsX.exe
  C:\Windows\System\pXGMPsX.exe
  2⤵
  PID:8164
- C:\Windows\System\bREQFqk.exe
  C:\Windows\System\bREQFqk.exe
  2⤵
  PID:8820
- C:\Windows\System\BjUZbag.exe
  C:\Windows\System\BjUZbag.exe
  2⤵
  PID:8828
- C:\Windows\System\onVGCKD.exe
  C:\Windows\System\onVGCKD.exe
  2⤵
  PID:8856
- C:\Windows\System\wQetHUW.exe
  C:\Windows\System\wQetHUW.exe
  2⤵
  PID:8884
- C:\Windows\System\SLfsezj.exe
  C:\Windows\System\SLfsezj.exe
  2⤵
  PID:8904
- C:\Windows\System\AekTsoy.exe
  C:\Windows\System\AekTsoy.exe
  2⤵
  PID:8848
- C:\Windows\System\MPDEHxH.exe
  C:\Windows\System\MPDEHxH.exe
  2⤵
  PID:8896
- C:\Windows\System\ecIFarV.exe
  C:\Windows\System\ecIFarV.exe
  2⤵
  PID:8400
- C:\Windows\System\tmhDYcT.exe
  C:\Windows\System\tmhDYcT.exe
  2⤵
  PID:8516
- C:\Windows\System\ugeemHZ.exe
  C:\Windows\System\ugeemHZ.exe
  2⤵
  PID:8556
- C:\Windows\System\PFnVJcI.exe
  C:\Windows\System\PFnVJcI.exe
  2⤵
  PID:9204
- C:\Windows\System\GyLVgAf.exe
  C:\Windows\System\GyLVgAf.exe
  2⤵
  PID:9136
- C:\Windows\System\zbDXrqQ.exe
  C:\Windows\System\zbDXrqQ.exe
  2⤵
  PID:9156
- C:\Windows\System\AUwvaKc.exe
  C:\Windows\System\AUwvaKc.exe
  2⤵
  PID:8428
- C:\Windows\System\zDqUaaL.exe
  C:\Windows\System\zDqUaaL.exe
  2⤵
  PID:8504
- C:\Windows\System\sueLYVH.exe
  C:\Windows\System\sueLYVH.exe
  2⤵
  PID:8552
- C:\Windows\System\TSOYkqu.exe
  C:\Windows\System\TSOYkqu.exe
  2⤵
  PID:8968
- C:\Windows\System\CjtSHDW.exe
  C:\Windows\System\CjtSHDW.exe
  2⤵
  PID:9004
- C:\Windows\System\oqwmSwx.exe
  C:\Windows\System\oqwmSwx.exe
  2⤵
  PID:9088
- C:\Windows\System\uRRdtHd.exe
  C:\Windows\System\uRRdtHd.exe
  2⤵
  PID:9148
- C:\Windows\System\vNUovho.exe
  C:\Windows\System\vNUovho.exe
  2⤵
  PID:7856
- C:\Windows\System\laaKvmK.exe
  C:\Windows\System\laaKvmK.exe
  2⤵
  PID:8920
- C:\Windows\System\McKjkuf.exe
  C:\Windows\System\McKjkuf.exe
  2⤵
  PID:8536
- C:\Windows\System\kZiPtpo.exe
  C:\Windows\System\kZiPtpo.exe
  2⤵
  PID:8484
- C:\Windows\System\QVEWulW.exe
  C:\Windows\System\QVEWulW.exe
  2⤵
  PID:8952
- C:\Windows\System\PJftvLZ.exe
  C:\Windows\System\PJftvLZ.exe
  2⤵
  PID:8604
- C:\Windows\System\feEhTON.exe
  C:\Windows\System\feEhTON.exe
  2⤵
  PID:8648
- C:\Windows\System\wuRMnTb.exe
  C:\Windows\System\wuRMnTb.exe
  2⤵
  PID:8384
- C:\Windows\System\hNWWFIs.exe
  C:\Windows\System\hNWWFIs.exe
  2⤵
  PID:9020
- C:\Windows\System\SPHsPjz.exe
  C:\Windows\System\SPHsPjz.exe
  2⤵
  PID:9072
- C:\Windows\System\SuaijjO.exe
  C:\Windows\System\SuaijjO.exe
  2⤵
  PID:9128
- C:\Windows\System\ZAFiQSm.exe
  C:\Windows\System\ZAFiQSm.exe
  2⤵
  PID:7760
- C:\Windows\System\gTqUYpp.exe
  C:\Windows\System\gTqUYpp.exe
  2⤵
  PID:8336
- C:\Windows\System\uOZPipT.exe
  C:\Windows\System\uOZPipT.exe
  2⤵
  PID:8576
- C:\Windows\System\meTJaFp.exe
  C:\Windows\System\meTJaFp.exe
  2⤵
  PID:8616
- C:\Windows\System\SvBhpnS.exe
  C:\Windows\System\SvBhpnS.exe
  2⤵
  PID:8808
- C:\Windows\System\AzpGoGk.exe
  C:\Windows\System\AzpGoGk.exe
  2⤵
  PID:8764
- C:\Windows\System\gYTsEYw.exe
  C:\Windows\System\gYTsEYw.exe
  2⤵
  PID:8836
- C:\Windows\System\DmXCOaE.exe
  C:\Windows\System\DmXCOaE.exe
  2⤵
  PID:8728
- C:\Windows\System\OPyatXi.exe
  C:\Windows\System\OPyatXi.exe
  2⤵
  PID:8912
- C:\Windows\System\caCloff.exe
  C:\Windows\System\caCloff.exe
  2⤵
  PID:8860
- C:\Windows\System\rGXtlBm.exe
  C:\Windows\System\rGXtlBm.exe
  2⤵
  PID:9144
- C:\Windows\System\SyThtSh.exe
  C:\Windows\System\SyThtSh.exe
  2⤵
  PID:8220
- C:\Windows\System\sPsItyP.exe
  C:\Windows\System\sPsItyP.exe
  2⤵
  PID:8524
- C:\Windows\System\ueJcVns.exe
  C:\Windows\System\ueJcVns.exe
  2⤵
  PID:7612
- C:\Windows\System\EOTohza.exe
  C:\Windows\System\EOTohza.exe
  2⤵
  PID:8984
- C:\Windows\System\sixVCXO.exe
  C:\Windows\System\sixVCXO.exe
  2⤵
  PID:9196
- C:\Windows\System\gEstAXW.exe
  C:\Windows\System\gEstAXW.exe
  2⤵
  PID:8748
- C:\Windows\System\nxTHsxr.exe
  C:\Windows\System\nxTHsxr.exe
  2⤵
  PID:8256
- C:\Windows\System\ynUvbus.exe
  C:\Windows\System\ynUvbus.exe
  2⤵
  PID:8796
- C:\Windows\System\UxpRvov.exe
  C:\Windows\System\UxpRvov.exe
  2⤵
  PID:8444
- C:\Windows\System\qsgmFYO.exe
  C:\Windows\System\qsgmFYO.exe
  2⤵
  PID:8752
- C:\Windows\System\gLBCgIk.exe
  C:\Windows\System\gLBCgIk.exe
  2⤵
  PID:8488
- C:\Windows\System\etIQnRk.exe
  C:\Windows\System\etIQnRk.exe
  2⤵
  PID:8932
- C:\Windows\System\RzDBhCH.exe
  C:\Windows\System\RzDBhCH.exe
  2⤵
  PID:8268
- C:\Windows\System\nbKmzzc.exe
  C:\Windows\System\nbKmzzc.exe
  2⤵
  PID:8832
- C:\Windows\System\MBAkAiD.exe
  C:\Windows\System\MBAkAiD.exe
  2⤵
  PID:8368
- C:\Windows\System\BgTweQs.exe
  C:\Windows\System\BgTweQs.exe
  2⤵
  PID:8244
- C:\Windows\System\THKGjSQ.exe
  C:\Windows\System\THKGjSQ.exe
  2⤵
  PID:8520
- C:\Windows\System\VmsnvuJ.exe
  C:\Windows\System\VmsnvuJ.exe
  2⤵
  PID:8892
- C:\Windows\System\BkIfmoN.exe
  C:\Windows\System\BkIfmoN.exe
  2⤵
  PID:8224
- C:\Windows\System\AkNZjJW.exe
  C:\Windows\System\AkNZjJW.exe
  2⤵
  PID:8508
- C:\Windows\System\uwilcNt.exe
  C:\Windows\System\uwilcNt.exe
  2⤵
  PID:8716
- C:\Windows\System\ETkXOXk.exe
  C:\Windows\System\ETkXOXk.exe
  2⤵
  PID:1572
- C:\Windows\System\NiWQRKB.exe
  C:\Windows\System\NiWQRKB.exe
  2⤵
  PID:8316
- C:\Windows\System\VAiFFAh.exe
  C:\Windows\System\VAiFFAh.exe
  2⤵
  PID:9208
- C:\Windows\System\dZvBtQH.exe
  C:\Windows\System\dZvBtQH.exe
  2⤵
  PID:9032
- C:\Windows\System\tCSFeFf.exe
  C:\Windows\System\tCSFeFf.exe
  2⤵
  PID:8880
- C:\Windows\System\DOvkCAs.exe
  C:\Windows\System\DOvkCAs.exe
  2⤵
  PID:8868
- C:\Windows\System\kVPDtPm.exe
  C:\Windows\System\kVPDtPm.exe
  2⤵
  PID:8320
- C:\Windows\System\zACAiSM.exe
  C:\Windows\System\zACAiSM.exe
  2⤵
  PID:8700
- C:\Windows\System\EcEejRT.exe
  C:\Windows\System\EcEejRT.exe
  2⤵
  PID:9068
- C:\Windows\System\GooGuEH.exe
  C:\Windows\System\GooGuEH.exe
  2⤵
  PID:6192
- C:\Windows\System\CwlxSTP.exe
  C:\Windows\System\CwlxSTP.exe
  2⤵
  PID:8448
- C:\Windows\System\qLSnxRH.exe
  C:\Windows\System\qLSnxRH.exe
  2⤵
  PID:9232
- C:\Windows\System\gSnTMeq.exe
  C:\Windows\System\gSnTMeq.exe
  2⤵
  PID:9252
- C:\Windows\System\CGOoxRF.exe
  C:\Windows\System\CGOoxRF.exe
  2⤵
  PID:9268
- C:\Windows\System\pssafot.exe
  C:\Windows\System\pssafot.exe
  2⤵
  PID:9284
- C:\Windows\System\ABVuibF.exe
  C:\Windows\System\ABVuibF.exe
  2⤵
  PID:9300
- C:\Windows\System\bzIBumd.exe
  C:\Windows\System\bzIBumd.exe
  2⤵
  PID:9316
- C:\Windows\System\bMkOFYm.exe
  C:\Windows\System\bMkOFYm.exe
  2⤵
  PID:9332
- C:\Windows\System\FoNieGu.exe
  C:\Windows\System\FoNieGu.exe
  2⤵
  PID:9348
- C:\Windows\System\GgCGUPQ.exe
  C:\Windows\System\GgCGUPQ.exe
  2⤵
  PID:9364
- C:\Windows\System\hxGpavZ.exe
  C:\Windows\System\hxGpavZ.exe
  2⤵
  PID:9380
- C:\Windows\System\xJrjSty.exe
  C:\Windows\System\xJrjSty.exe
  2⤵
  PID:9396
- C:\Windows\System\lEljjsr.exe
  C:\Windows\System\lEljjsr.exe
  2⤵
  PID:9412
- C:\Windows\System\GgDwUTY.exe
  C:\Windows\System\GgDwUTY.exe
  2⤵
  PID:9428
- C:\Windows\System\BezuVhD.exe
  C:\Windows\System\BezuVhD.exe
  2⤵
  PID:9448
- C:\Windows\System\RfLKsuB.exe
  C:\Windows\System\RfLKsuB.exe
  2⤵
  PID:9464
- C:\Windows\System\LlLqBbI.exe
  C:\Windows\System\LlLqBbI.exe
  2⤵
  PID:9480
- C:\Windows\System\hqNKwZX.exe
  C:\Windows\System\hqNKwZX.exe
  2⤵
  PID:9496
- C:\Windows\System\krSAQXJ.exe
  C:\Windows\System\krSAQXJ.exe
  2⤵
  PID:9516
- C:\Windows\System\wonAxYe.exe
  C:\Windows\System\wonAxYe.exe
  2⤵
  PID:9532
- C:\Windows\System\gzfNISD.exe
  C:\Windows\System\gzfNISD.exe
  2⤵
  PID:9548
- C:\Windows\System\rwOqBts.exe
  C:\Windows\System\rwOqBts.exe
  2⤵
  PID:9564
- C:\Windows\System\jsHxzjk.exe
  C:\Windows\System\jsHxzjk.exe
  2⤵
  PID:9580
- C:\Windows\System\IvPnkju.exe
  C:\Windows\System\IvPnkju.exe
  2⤵
  PID:9596
- C:\Windows\System\OksTkqF.exe
  C:\Windows\System\OksTkqF.exe
  2⤵
  PID:9616
- C:\Windows\System\omqJmHT.exe
  C:\Windows\System\omqJmHT.exe
  2⤵
  PID:9632
- C:\Windows\System\PXpSqvl.exe
  C:\Windows\System\PXpSqvl.exe
  2⤵
  PID:9652
- C:\Windows\System\EHExEpu.exe
  C:\Windows\System\EHExEpu.exe
  2⤵
  PID:9668
- C:\Windows\System\DQiShVo.exe
  C:\Windows\System\DQiShVo.exe
  2⤵
  PID:9684
- C:\Windows\System\psimyFL.exe
  C:\Windows\System\psimyFL.exe
  2⤵
  PID:9760
- C:\Windows\System\OTcxdxP.exe
  C:\Windows\System\OTcxdxP.exe
  2⤵
  PID:9776
- C:\Windows\System\BeHJoOG.exe
  C:\Windows\System\BeHJoOG.exe
  2⤵
  PID:9792
- C:\Windows\System\QtwavFQ.exe
  C:\Windows\System\QtwavFQ.exe
  2⤵
  PID:9808
- C:\Windows\System\UZxWNBk.exe
  C:\Windows\System\UZxWNBk.exe
  2⤵
  PID:9824
- C:\Windows\System\Yvospty.exe
  C:\Windows\System\Yvospty.exe
  2⤵
  PID:9840
- C:\Windows\System\rAaaxOw.exe
  C:\Windows\System\rAaaxOw.exe
  2⤵
  PID:9856
- C:\Windows\System\lJDRkpJ.exe
  C:\Windows\System\lJDRkpJ.exe
  2⤵
  PID:9872
- C:\Windows\System\vnFpQkD.exe
  C:\Windows\System\vnFpQkD.exe
  2⤵
  PID:9888
- C:\Windows\System\imVXHSF.exe
  C:\Windows\System\imVXHSF.exe
  2⤵
  PID:9904
- C:\Windows\System\FnMMFlj.exe
  C:\Windows\System\FnMMFlj.exe
  2⤵
  PID:9920
- C:\Windows\System\VFDgLft.exe
  C:\Windows\System\VFDgLft.exe
  2⤵
  PID:9936
- C:\Windows\System\TNvabfj.exe
  C:\Windows\System\TNvabfj.exe
  2⤵
  PID:9952
- C:\Windows\System\azaekvQ.exe
  C:\Windows\System\azaekvQ.exe
  2⤵
  PID:9968
- C:\Windows\System\dlLBAen.exe
  C:\Windows\System\dlLBAen.exe
  2⤵
  PID:9984
- C:\Windows\System\RjZLXcV.exe
  C:\Windows\System\RjZLXcV.exe
  2⤵
  PID:10000
- C:\Windows\System\PoUdqRh.exe
  C:\Windows\System\PoUdqRh.exe
  2⤵
  PID:10020
- C:\Windows\System\iYiDhip.exe
  C:\Windows\System\iYiDhip.exe
  2⤵
  PID:10036
- C:\Windows\System\qMZlndv.exe
  C:\Windows\System\qMZlndv.exe
  2⤵
  PID:10088
- C:\Windows\System\GzKvDhK.exe
  C:\Windows\System\GzKvDhK.exe
  2⤵
  PID:10104
- C:\Windows\System\HzxSjqr.exe
  C:\Windows\System\HzxSjqr.exe
  2⤵
  PID:10120
- C:\Windows\System\wgQGcbL.exe
  C:\Windows\System\wgQGcbL.exe
  2⤵
  PID:10136
- C:\Windows\System\Wnzfthe.exe
  C:\Windows\System\Wnzfthe.exe
  2⤵
  PID:10152
- C:\Windows\System\DDVDugP.exe
  C:\Windows\System\DDVDugP.exe
  2⤵
  PID:10172
- C:\Windows\System\xeNvqTC.exe
  C:\Windows\System\xeNvqTC.exe
  2⤵
  PID:10188
- C:\Windows\System\RhvaleW.exe
  C:\Windows\System\RhvaleW.exe
  2⤵
  PID:10204
- C:\Windows\System\DDSpFuf.exe
  C:\Windows\System\DDSpFuf.exe
  2⤵
  PID:10220
- C:\Windows\System\dvhwfXQ.exe
  C:\Windows\System\dvhwfXQ.exe
  2⤵
  PID:8676
- C:\Windows\System\HXHxCVs.exe
  C:\Windows\System\HXHxCVs.exe
  2⤵
  PID:9240
- C:\Windows\System\CkTXcRQ.exe
  C:\Windows\System\CkTXcRQ.exe
  2⤵
  PID:9280
- C:\Windows\System\vzOnfpW.exe
  C:\Windows\System\vzOnfpW.exe
  2⤵
  PID:9344
- C:\Windows\System\FwdpqRO.exe
  C:\Windows\System\FwdpqRO.exe
  2⤵
  PID:9408
- C:\Windows\System\VyKIaDU.exe
  C:\Windows\System\VyKIaDU.exe
  2⤵
  PID:9224
- C:\Windows\System\VYHDCcc.exe
  C:\Windows\System\VYHDCcc.exe
  2⤵
  PID:9424
- C:\Windows\System\bumrTWb.exe
  C:\Windows\System\bumrTWb.exe
  2⤵
  PID:9260
- C:\Windows\System\ZOTIXDU.exe
  C:\Windows\System\ZOTIXDU.exe
  2⤵
  PID:9292
- C:\Windows\System\jfofodr.exe
  C:\Windows\System\jfofodr.exe
  2⤵
  PID:9360
- C:\Windows\System\wPqqMXG.exe
  C:\Windows\System\wPqqMXG.exe
  2⤵
  PID:9504
- C:\Windows\System\NclQVpN.exe
  C:\Windows\System\NclQVpN.exe
  2⤵
  PID:9512
- C:\Windows\System\LNGUsiC.exe
  C:\Windows\System\LNGUsiC.exe
  2⤵
  PID:9488
- C:\Windows\System\EBTlQst.exe
  C:\Windows\System\EBTlQst.exe
  2⤵
  PID:9608
- C:\Windows\System\RqpnJvt.exe
  C:\Windows\System\RqpnJvt.exe
  2⤵
  PID:9676
- C:\Windows\System\QehOZVT.exe
  C:\Windows\System\QehOZVT.exe
  2⤵
  PID:9556
- C:\Windows\System\Ubgzutt.exe
  C:\Windows\System\Ubgzutt.exe
  2⤵
  PID:9624
- C:\Windows\System\efWwCIS.exe
  C:\Windows\System\efWwCIS.exe
  2⤵
  PID:9712
- C:\Windows\System\KddSedu.exe
  C:\Windows\System\KddSedu.exe
  2⤵
  PID:9736
- C:\Windows\System\SctxfwO.exe
  C:\Windows\System\SctxfwO.exe
  2⤵
  PID:9752
- C:\Windows\System\unJcvVR.exe
  C:\Windows\System\unJcvVR.exe
  2⤵
  PID:9820
- C:\Windows\System\bObVVUL.exe
  C:\Windows\System\bObVVUL.exe
  2⤵
  PID:9884
- C:\Windows\System\yWNgOsw.exe
  C:\Windows\System\yWNgOsw.exe
  2⤵
  PID:9948
- C:\Windows\System\IhcRFpf.exe
  C:\Windows\System\IhcRFpf.exe
  2⤵
  PID:9896
- C:\Windows\System\NXILkRa.exe
  C:\Windows\System\NXILkRa.exe
  2⤵
  PID:10112
- C:\Windows\System\oiLZYbK.exe
  C:\Windows\System\oiLZYbK.exe
  2⤵
  PID:10044
- C:\Windows\System\WNdJQBA.exe
  C:\Windows\System\WNdJQBA.exe
  2⤵
  PID:10076
- C:\Windows\System\bekaDOK.exe
  C:\Windows\System\bekaDOK.exe
  2⤵
  PID:10084
- C:\Windows\System\zgIjArS.exe
  C:\Windows\System\zgIjArS.exe
  2⤵
  PID:10180
- C:\Windows\System\nhHWVXZ.exe
  C:\Windows\System\nhHWVXZ.exe
  2⤵
  PID:8460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AQdkgXs.exe

Filesize
1.9MB

MD5
93b836e64b4f59a2ebe6290a945b2486

SHA1
b175990dd5e1905756224b32269deeec7c43ee07

SHA256
55c7efa4ad0bf0580f48753dcffd85c9d484b66d418b5ceab74a24bdcea08fc8

SHA512
f089acc399ec0b502e9269745fc91b6ae9c96acd291d3fefbc7acb3f23dee4600af866524c39a91465747a91a07b7aee4b902e9001151a32b4fbeaaf8e1ba4fa

Download Submit
C:\Windows\system\BEZaluM.exe

Filesize
1.9MB

MD5
faa3a1e76e7d8a9f56f0b1013b16f7ac

SHA1
2f69236a495d42dd729d8fcea4fa475648a8edb3

SHA256
173317f5debfade8d937a5883b19fe88d824619b5b053f3deacbf18bbbfe69aa

SHA512
d54e62629bba1a2bc277c97336577d64b19af2348c2c315294029d26a44c8f8a3972c9fbc85f26d59ddd1889b867ca6e8211f230d908fb0d98f30386e7cf00ae

Download Submit
C:\Windows\system\GwFUmGz.exe

Filesize
1.9MB

MD5
7f01fff97501d956913a62b88d958b3e

SHA1
be2f9acce49af21a7bab37aa99b0e4af9ab782e2

SHA256
ea732eef04e002e4efcba56e8d2f01cebc681a6a9f720f4cba10830c73192b34

SHA512
e54c47fc3c91917fdfae6eb1c337b838b97cd03cb13c363c0b44dcf45b3a43e7a39681a104fc7b3ae16dd5f0623087ca2eabc1038b1a9d7ea1c71f57510d8cc9

Download Submit
C:\Windows\system\JpkwPgq.exe

Filesize
1.9MB

MD5
2d2959230681d0433c9e004b5c29779d

SHA1
70b81a918965d2626ad8a8b7236d5039720da31d

SHA256
f4cbb78efe8a07098e64f3d50a293eb2a88a2ed04758470b1ce8663c0e41d2e0

SHA512
34d61f9498ba612e8f8a32ffe61341283d0c629dc3a1ab6a908d66e50c2634c264f4e99148312ae19e9d2fc63d836ea17fffa0dc706323c16f3c84ad6b96cbdb

Download Submit
C:\Windows\system\KvJRpYX.exe

Filesize
1.9MB

MD5
4ea7ac9a6a401f8987a1ce3d39d9e3ac

SHA1
825681e536fdc104919dbae8b19adff48c06e13e

SHA256
59e79c03396f32ba573335161dcd6317f8b7924581974cc0459d8f49760e1c60

SHA512
18d746c0fe02c2676ace6a6442931858be624e6c70370e6554889026cee1d75c647f8c0b7c87ca58fda7cbccae850bf996b87a3d1aa2b5bce051c700d8df56d6

Download Submit
C:\Windows\system\MRaAkqi.exe

Filesize
1.9MB

MD5
96349cbae7d25d792a9ac11c84bfe051

SHA1
a9e48b3a55e9f84bbc8b66b6772e2add0c9ddffd

SHA256
111690f9d739d98aaeff47e85691e83f6486f0d500dcf9cb6bba648deaf77809

SHA512
1d42978b90c21a4a2b3074eedf66286d807e05124366ad066a1ec080b55b2fdc019d3729720fe358003b586347ebd595ba2e1391b744acb2c1c53f61cb8b126d

Download Submit
C:\Windows\system\NFShACU.exe

Filesize
1.9MB

MD5
d42d49dbcd2f0e11f079babaef89db25

SHA1
56f32390872880a666743970029d104a77baaeff

SHA256
1a572ad3a73df3bbdce9f2b1a32a18c49377a8cbcf084f6f3ec02335ceb5a5d5

SHA512
9a29fbd158d80e06c403d18b9a54c6f7d2348555ae362e19ec3deabf7b061f7015796f15572fcdf234737cd36880f198b238ac70f15855cfdc74a04f82d49e18

Download Submit
C:\Windows\system\NaAsYsT.exe

Filesize
1.9MB

MD5
7d7b80631d10856fc6712e092cd2706d

SHA1
b5567ee65ec6613e3a8cc41974eaabaee2a45c03

SHA256
5a68f198022efb403487fd65549e2e8f2f03c0516835fcd87d56ba0c1453b31f

SHA512
a4c1419ce5011bde5b6d4bd33a2110a7c11eaa71d42701fa01e6e9385b49cf028fa069530643e14df34c933adb8c0c76882822f957365795e00cf354070fcc18

Download Submit
C:\Windows\system\NzfarpT.exe

Filesize
1.9MB

MD5
5424ff07122355a79cd4252ee58f731e

SHA1
7a7a8e8df1d7651ff6c14c1d96c65bd85876d197

SHA256
c97dcd6019ef30992ce1a83d7b827254415866e61117441fa07b25f660f8a984

SHA512
cc3e1ab43166f8e74a5433266d65c0fd5d9150208a0c77cb3a1bf9ef9c2f051a6187a2ec68f262ae89323643f5ab83f393a948337a05454ba9b2d2087a7368e7

Download Submit
C:\Windows\system\QsnHhxx.exe

Filesize
1.9MB

MD5
887c9ebb889e0d875401794300102049

SHA1
247b8b723d796585dcdf756cb3860d8d723e9985

SHA256
25e846b993ff7c1d4313151ae04b692c8b40a0c44292dcada684531d220a9e29

SHA512
345119ce1d5a287aa5a445dce2696dd16e8945236dc3207348cde3cedb7d0cc922e2a821552a173277cc47a091fd8e72670e9cd2ae0f2905f2ed3e50a2cd6662

Download Submit
C:\Windows\system\VPCKpGv.exe

Filesize
1.9MB

MD5
891420663383c07334e30db4428ddc7f

SHA1
421f47bb33b1cac2850093b4313906668d286cf2

SHA256
64f3504ea761ae9e19898c7132d71b21ebb7261be3e9c33d77404af14c562021

SHA512
4767ad5178491809053bf5d8e77063d72565f07883a002d3a152b46527a627a8633c861f24f0bc1be711339dbbb9daa6c9b40ba4fa4e82b898e720d607744908

Download Submit
C:\Windows\system\WFUMgTM.exe

Filesize
1.9MB

MD5
e3f7a085cb12aaa65e3992bd7295485f

SHA1
ee7c0d886cb29bc0c6c084923ec923918fe87ffd

SHA256
2a4fe9606316c4e73b78746848bf6bf5e7497643a0d038dfb569a0182bfdbb19

SHA512
c8c6ee57542bcadc374f65228175648f77a6a80d1e25c1019c66759a12565d89cb2524bce29d86187ecf2e0992107d8cba7d95115ba124c332a20a46783f6c84

Download Submit
C:\Windows\system\WPPpsbh.exe

Filesize
1.9MB

MD5
295edf0ef5868e18156e4ac34e03a90f

SHA1
04b5e8202be1f8bba453b8e7cb4b0818dc191e14

SHA256
bfd9438272cfdaf2f58d94e7270397ed1c1920226bf0d9adce177a84b7d510fd

SHA512
3c6a528e32ff424b80b81d126f517543b348676a525717f20abf087c74b5bd7447aeda95770160b056da2a992ddc70d96ea0c0c7d8c9e6cdb97b86ed53dfbc96

Download Submit
C:\Windows\system\YPMTbwA.exe

Filesize
1.9MB

MD5
a67873d09b85701573b02358c0143163

SHA1
07a42540e55da7f5c004c99f91f71b0772b84d75

SHA256
9b90c48599f8d3f445d413c0bdda1c9ac97b5451e954ad59df859a0daeed4fc7

SHA512
8e49967321d0831ca012a6f7a9f13aea4a4e22bc46b2775e4b233a3ce3ad30b9ca9f417f36676c79c4e919af5c166c725d7d182825caa13cae3d01e2c005a640

Download Submit
C:\Windows\system\ZsGcMzD.exe

Filesize
1.9MB

MD5
1bf32afcb35600a4634faa7ace5eefc0

SHA1
8fa1f9563cddb94b99abbc09dd4b3e02c25fe754

SHA256
92c2d4dd3dedb9b03ea9713a48bf7bfae3e2102314a2b0c23de2f075c6729969

SHA512
79f985d1d40793257a27c61789298d5cb80a981fc99e984e1e74f629394e044e36132ef19d9235cb513ae594f7617bf010211d8f31d7bc406aa672ec16d39223

Download Submit
C:\Windows\system\cvcDWUw.exe

Filesize
1.9MB

MD5
eb8cde0136675e724dd67d0b5938a426

SHA1
590324bc9123a6026a738aaa95fb97d2d8f280f9

SHA256
71f8199b967ffdf8716796266d44aa0073704edf8ff1ef94546f78a8f8e9478c

SHA512
345edd1cb318710b3c5f6a23c2a05d40bfe78be9adab188a44d304f621f1022579c373b85defe9735d294dd2a84768344cf6e076c1e4962b0fa67b983e8e1b10

Download Submit
C:\Windows\system\epqwkwY.exe

Filesize
1.9MB

MD5
245a6664bab6d626a2890015795d8c38

SHA1
c926681ebcf86d7750ab7804e0539f506fefcc7d

SHA256
dea8c604f5e2c35dc175677719da42f6095cff93869627eadb6abfc918d3a26b

SHA512
7f4611bb38c1e895de6eea36c155db007656ea53ebadecb4c5c115ce987236ae99af7f03fd35984c5371f7d4dedd70e456894bd6b9eaa65065ab0f2dc906a267

Download Submit
C:\Windows\system\fqJwSJF.exe

Filesize
1.9MB

MD5
9412b216e35c81775e276b6b39e23ea3

SHA1
a4de2aab2940540870401d847709b4e8a0829e25

SHA256
45d718ae3f93155713e84e93f84aa0938cf2c9185a85bba454c292021c148717

SHA512
6077e5147f20169c0d6a5087b17b701f8c55577aa3a6eb110e5ea26bd518d01a1d980b053d8ab7bd2862fc015b8222b32db4457e75e02dd1959330ef4c27e677

Download Submit
C:\Windows\system\kJeaFAA.exe

Filesize
1.9MB

MD5
de3a5d6816cb9b1ae8bb7a99ff716b97

SHA1
6a0a1aaff54d2b2762c292f455c7bdeb34233806

SHA256
857b0531495f483084146180958e30d4f3181c078c34b6c6dfc003a98e51a108

SHA512
bc5b52846445a039f1c8080abf16df4ae7dc2171e40f594a6473b6a6406146b8be73c657fee967c8d636bea05a1a512d1a3bba3ef57dd90e3b8a7a3f4726ae19

Download Submit
C:\Windows\system\lOUijFC.exe

Filesize
1.9MB

MD5
7dc2068a5b45e7b2cf65ea4c4f3013b9

SHA1
8b64eceaf2dc4e1d817eb1c359954e350f33aa53

SHA256
8cb711b3b5a25ba56af438a3ad407f71f364e91d440c98846abcbf999298e759

SHA512
80b9b59270085e1523f78975d638e9c6f0fc65020a88d5e41731aef273161369d8edff47720864f8de2165a1d1669b23f7af361a08b2843962a61f947c06fc61

Download Submit
C:\Windows\system\nzQTgHP.exe

Filesize
1.9MB

MD5
e72c1c60b767c2c874675ef5311012a1

SHA1
1c0fde5ea722fa357c43eaedda04bff2f00c4377

SHA256
5319ff3e3f9099a35a5d9f426b539a3a69351e3f26af8a4238b55d9081362d79

SHA512
1ff092deab9ad6e93f57f7f45666fd893719d48a72271b7b59236b1e36c62cf60e99f95464ce0719100bf4b4d5589708b54ca824f41dccdf52fc2a072d4b8046

Download Submit
C:\Windows\system\sdvjONT.exe

Filesize
1.9MB

MD5
a5c9dc03aaf5f0a03422743fc33e25f6

SHA1
8a806d9ced1652cc4b867010178e107c420fe209

SHA256
baabf692bb93cb27755a9d30643ee5189666b96cdec040b92f9cdaa3cddc5562

SHA512
31b98a55cd301cbc8237f82563fe1e82bd2602cd0615f0c46e4da1eacb8b8c1e643b5418a0789feb73c6f4501168d77238d659d835686b26e2763d4c1e644e7e

Download Submit
C:\Windows\system\tpuBUGu.exe

Filesize
1.9MB

MD5
398aae938db8eee2e880bc69eb61c991

SHA1
50b0c4ae499ac2926dc340b5b9e9004c3a5fb3c7

SHA256
878d9c99f67bcd52551576f7c1afceaf2ffaff2feb78e251ee1a0ea0a1f8dc6f

SHA512
d91351fe3f457232234de96bd60f7338aa4a5d2301a0cd2b9317bd9db33ba395bd2073c660acccedd381325856f148f3d347502a3a201174705b4e61a97e8196

Download Submit
C:\Windows\system\vOaLUJL.exe

Filesize
1.9MB

MD5
d40259547a5b1f2abf6886d3ca04b1e1

SHA1
abef84c8cc24d8b6a97773d7726e122a9cb610f3

SHA256
e0dd79dddfaee6836a035a5e807f70e504fc8783b46cedeabd28f4b753944242

SHA512
da8d2ebe1569d17037dfb1dac2402a06b5e1edb5603dca11a15d929b635613d0a1292fcffc26e38d140fa9b5e3039ae481dd69e56289ebfabad1a7f52872419c

Download Submit
\Windows\system\POlmTHy.exe

Filesize
1.9MB

MD5
5ebb65175092967e2c10f2f28cff3bd3

SHA1
d5e63fab1e0fd2b9be246b542bccef281e12daf3

SHA256
d8651cc286a2a33db2becd41ba8cb66e82521ed9340fa4bd50e3736dc83c2521

SHA512
9d61a9e86fd1c36016e364ea4372acb3ee3265de81cbd7dd72c646179e57c97828b69b2ba87f075bd7e98dfdb125da311d7a57f0f70870d74e8ccb04aec34fe6

Download Submit
\Windows\system\WvFcMWk.exe

Filesize
1.9MB

MD5
db6c85023e6e6cb6933aff1776b2164f

SHA1
2f07d14b29700bb18e13beb413961d92f58645d0

SHA256
bf8cb34eb4672782494e426e0801016bc8c5bd1c71a90b3276cf47a05f26ef27

SHA512
99e47b14847b6a8900c02f47f101e6c08e2dcd91b9907e45cd2db59d70e5e0131deb32674d378066b8542fd7eecccde38e80065bf34bbd97c1730eafcf6a5fe7

Download Submit
\Windows\system\acmxiDl.exe

Filesize
1.9MB

MD5
ea7042eb5b54513e3e6cf4578a276df0

SHA1
bcfd16f2cf31e1b66693fd347cdbd5a6b93bcfba

SHA256
ed08e1dbc0a56d5602b2b8ab1dccbac80acc4ef00944f9a2a390605e9493653a

SHA512
f40e3ed182fb5c04467672eef10cbf645d2b58edf752b0890f674c2d3e7ab8fd6fb1fb16a76a4ed2b3772af1338eecf71618e5edfaa677a99838b82ce69d89a1

Download Submit
\Windows\system\eAXxdas.exe

Filesize
1.9MB

MD5
c736e18fcda40e760341fd36490e8fe5

SHA1
86633b9b4e7f80c650d04ceb01ebf5d4eab5e3ed

SHA256
abd7be1520d168b2647bc9d4e1fdba02673baa453ad71a3e4ca29d20a39a3052

SHA512
db72e47e93da3438f3afa18fee16a47834371e2d26a16760cc57ae584bc5281f62d4bceeba5f6d2fecd4c409e124a187264482e77816ebd19551f5f2db52b614

Download Submit
\Windows\system\mDYVMzv.exe

Filesize
1.9MB

MD5
a5f65676c7ecf5937841c8a77b55cb6d

SHA1
7907a611637cf504b961b1842ac9f3ddf5f1401a

SHA256
5f9a9de0160465c24c30a008e39e62bbc59540a5dbc58c2ff7f2c9b3fb63f85a

SHA512
710a0519cb15120b1265ee83c325fd91bbe841d11d1e733aff8219946978f7e0d497a6b9e4adf6829d06604ee9a39573a348bf7f2e543f0cc4e2ae0fa27487cd

Download Submit
\Windows\system\nfjguZs.exe

Filesize
1.9MB

MD5
035e8efb9d1c69597290b56012b31339

SHA1
23d75da6d669e28f5f898672a0f5334088d777b3

SHA256
978d4942d75f85efe3292574058ea0b4a3d0f85518c96ef05c13b0715f996c22

SHA512
b322dc4ee1890432fab8d972d565db6598d52ba33f8a2d0c0430a35698f62178d01da7b25dca6139d976c7eb8d5c21e34f9a5050a573fc82dbd6122861fc6b3e

Download Submit
\Windows\system\vTZeqBE.exe

Filesize
1.9MB

MD5
854595c0fef34f8c809c98c7ea5dd924

SHA1
4702743b84ce9172421533d81042d6bcc03b4fe7

SHA256
a60c71b9592f461ea4cd4b7e1c7aa60191a3e64615b01df22cd7504db3bbf60d

SHA512
f747d5ccd3beab86e09e0dea3f6cc229fc25ccc527770e460291d62ba49aa70243d8c775991b5274f3eed97971e0db6773678d11c645c6b338f071e4c294b359

Download Submit
\Windows\system\wqufjyL.exe

Filesize
1.9MB

MD5
7878f45dc9eb6417da5172ad8182e5f1

SHA1
280a5449abc0b0e87ba1b9150768080e09f382fb

SHA256
d6286a16b0c02d3f2442b72a33108b2169dac580c04fd7239d89290a456461b8

SHA512
6b1ee0362edce051b6625849de68c69b4337293cbd3b56b43d756c716c0bec1465a67870f25c8e7090ca27967a8bdf88b502ff36aa42ef2bd131dd0f98f61752

Download Submit
memory/1908-13-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2376-147-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2376-115-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2376-451-0x000007FEF5320000-0x000007FEF5CBD000-memory.dmp

Filesize
9.6MB

Download
memory/2376-30-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2376-14-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2376-70-0x0000000002690000-0x0000000002698000-memory.dmp

Filesize
32KB

Download
memory/2376-107-0x000007FEF5320000-0x000007FEF5CBD000-memory.dmp

Filesize
9.6MB

Download
memory/2376-146-0x000007FEF5320000-0x000007FEF5CBD000-memory.dmp

Filesize
9.6MB

Download
memory/2552-119-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-116-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2636-108-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2668-125-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-133-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2816-123-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2844-114-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2844-109-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/2844-12-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/2844-124-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/2844-113-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/2844-112-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2844-122-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/2844-117-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2844-140-0x00000000035A0000-0x0000000003992000-memory.dmp

Filesize
3.9MB

Download
memory/2844-139-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2844-0-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2844-148-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2864-110-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download